System device files in writable directories could be modified, removed, or used by an unprivileged user to control system hardware.System AdministratorEC
Find all device special files existing anywhere on the system. Types include: b=block, c=character, p=fifo.
# find / -type b -print >> devicelist
# find / -type c -print >> devicelist
# find / -type p -print >> devicelist
Check the permissions on the directories above subdirectories that contain device files. If any device file, or directory containing device files, is world-writable, except device files specifically intended to be world-writable such as /dev/null, this is a finding.
Note the following exception/exclusion list:
/dev/pts/*, /dev/pty/*, /dev/ptym/*, the following in dev: full, zero, null, tty, ptmx, pty*, tcp, udp, ip, arp, udp6, tcp6, rawip6, ip6, rawip, rtsock, ipsecpol, ipseckey, sad, dlpi*, sasd*, ttyp*, ttyq*, ttyr*, strlog, telnetm, tlclts, asyncdsk, async, tlcots, tlcotsod, echo, beep, gvid0, gvid, poll, log, log.um, stcpmap, nuls, usctp6, sctp6, usctp and sctp.
Remove the world-writable permission from the device file(s).
# chmod o-w <device file>
Document all changes.