Skip to content
ATO Pathways
  Log In

Enable Kernel Parameter to Enforce DAC on Symlinks

An XCCDF Rule

Description

To set the runtime status of the fs.protected_symlinks kernel parameter, run the following command: 

$ sudo sysctl -w fs.protected_symlinks=1
To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: 
fs.protected_symlinks = 1

Rationale

By enabling this kernel parameter, symbolic links are permitted to be followed only when outside a sticky world-writable directory, or when the UID of the link and follower match, or when the directory owner matches the symlink's owner. Disallowing such symlinks helps mitigate vulnerabilities based on insecure file system accessed by privileged programs, avoiding an exploitation vector exploiting unsafe use of open() or creat().

ID
xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks
Severity
Medium
References
Updated



Remediation - Ansible

- name: List /etc/sysctl.d/*.conf files
  find:
    paths:
    - /etc/sysctl.d/
    - /run/sysctl.d/
    - /usr/local/lib/sysctl.d/