1555
some protection. For example, java.io.FilePermission in the Java SecurityManager allows the
software to specify restrictions on file operations. This may not be a feasible solution, and it
only limits the impact to the operating system; the rest of the application may still be subject to
compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.
Effectiveness = Limited
The effectiveness of this mitigation depends on the prevention capabilities of the specific
sandbox or jail being used and might only help to reduce the scope of an attack, such as
restricting the attacker to certain system calls or limiting the portion of the file system that can be
accessed.
Phase: Implementation
Phase: Installation
During program startup, explicitly set the default permissions or umask to the most restrictive
setting possible. Also set the appropriate permissions during program installation. This will
prevent you from inheriting insecure permissions from any user who installs or runs the program.
Effectiveness = High
Phase: System Configuration
For all configuration files, executables, and libraries, make sure that they are only readable and
writable by the software's administrator.
Effectiveness = High
Phase: Documentation
Do not suggest insecure configuration changes in documentation, especially if those
configurations can extend to resources and other programs that are outside the scope of the
application.
Phase: Installation
Do not assume that a system administrator will manually change the configuration to the settings
that are recommended in the software's manual.
Phase: Operation
Phase: System Configuration
Strategy = Environment Hardening
Ensure that the software runs properly under the United States Government Configuration
Baseline (USGCB) [REF-199] or an equivalent hardening configuration guide, which many
organizations use to limit the attack surface and potential risk of deployed software.
Phase: Implementation
Phase: System Configuration
Phase: Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use
the provider's controls to disable public access.
Demonstrative Examples
Example 1:
The following code sets the umask of the process to 0 before creating a file and writing "Hello
world" into the file.
Example Language: C (Bad)
#define OUTFILE "hello.out"
umask(0);
CWE Version 4.14
CWE-732: Incorrect Permission Assignment for Critical Resource
CWE-732: Incorrect Permission Assignment for Critical Resource