Detections
Analytics

1.5.2 Ensure fs.protected_symlinks is configured

Information

fs.protected_symlinks controls how the kernel handles symbolic links. When enabled, symbolic links are followed only when outside a sticky world-writable directory, when the user identifier (UID) of the symlink and follower match, or when the directory owner matches the symlink's owner.

More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.

Disallowing symlinks mitigates vulnerabilities based on unsecure file systems accessed by privileged programs. This reduces the risk of an exploitation vector exploiting unsafe use of open or creat.

Solution

- Review all files being used by systemd sysctl and comment out or remove all fs.protected_symlinks lines that are not fs.protected_symlinks=1.

Example script:

#!/usr/bin/env bash

{
 l_option="fs.protected_symlinks" l_value="1"
 l_grep="${l_option//./(\\.|\\/)}" a_files=()
 l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
 || readlink -e /usr/lib/systemd/systemd-sysctl)"
 a_files+=("/etc/sysctl.conf")
 while IFS= read -r l_fname; do
 l_file="$(readlink -e "${l_fname//# /}")"
 [ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
 <<< "${a_files[*]}" && a_files+=("$l_file")
 done < <("$l_systemdsysctl" --cat-config | tac | \
 grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
 for l_file in "${a_files[@]}"; do
 grep -Psio -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
 | grep -Psivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
 sed -ri '/^\s*'"$l_grep"'\s*=\s*(0|[2-9]|1[0-9]+)/s/^/# /' "$l_file"
 done
}

 - Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:

fs.protected_symlinks = 1

Example:

# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "fs.protected_symlinks = 1" >> /etc/sysctl.d/60-fs_sysctl.conf

 - Run the following command to load all sysctl configuration files:

# sysctl --system

Impact:

Applications that legitimately rely on following symbolic links across differing UIDs within world-writable directories (for example, some services or build tooling that use /tmp ) may stop working. Validate the change in a test environment before enforcing it in production.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3(4)

Plugin: Unix

Control ID: 466cea9e505fac53dd6fd90f0bffba29447766e94389dfbc6a4bbe03f84ee313