1.5.1 Ensure fs.protected_hardlinks is configured

Information

fs.protected_hardlinks Controls the creation of hard links to files.

More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.

Disallowing hardlinks mitigates vulnerabilities based on unsecure file systems accessed by privileged programs. This reduces the risk of an exploitation vector exploiting unsafe use of open or creat.

Solution

- Review all files being used by systemd-sysctl and comment out or remove all fs.protected_hardlinks lines that are not fs.protected_hardlinks=1.

Example script:

#!/usr/bin/env bash

{
l_option=\"fs.protected_hardlinks\" l_value=\"1\"
l_grep=\"${l_option//./(\\.|\\/)}\" a_files=()
l_systemdsysctl=\"$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)\"
l_ufw_file=\"$([ -f /etc/default/ufw ] && \
awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"
[ -f \"$(readlink -e \"$l_ufw_file\")\" ] && \
a_files+=(\"$l_ufw_file\"); a_files+=(\"/etc/sysctl.conf\")
while IFS= read -r l_fname; do
l_file=\"$(readlink -e \"${l_fname//# /}\")\"
[ -n \"$l_file\" ] && ! grep -Psiq -- '(^|\h+)'\"$l_file\"'\b' \
<<< \"${a_files[*]}\" && a_files+=(\"$l_file\")
done < <(\"$l_systemdsysctl\" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in \"${a_files[@]}\"; do
grep -Psio -- '\h*'\"$l_grep\"'\h*=\h*\H+\b' \"$l_file\" \
| grep -Psivq -- '^\h*'\"$l_grep\"'\h*=\h*'\"$l_value\"'\b' && \
sed -ri '/^\s*'\"$l_grep\"'\s*=\s*(0|[2-9]|1[0-9]+)/s/^/# /' \"$l_file\"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:

fs.protected_hardlinks = 1

Example:

# [ ! -d \"/etc/sysctl.d/\" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' \"\" \"fs.protected_hardlinks = 1\" >> /etc/sysctl.d/60-fs_sysctl.conf

Note: If the UFW file was the first file listed in the audit, the entry will be commented out as part of the first step, however updating Uncomplicated Firewall (UFW) may update this change. In this case the updated entry will supersede the entry being created as part of this step.

- Run the following command to load all sysctl configuration files:

# sysctl --system

Impact:

Users will not be able to create soft or hard links to files they do not own.

Item Details

Audit Name: CIS Debian Linux 13 v1.0.0 L1 Server

Category: ACCESS CONTROL

Plugin: Unix

Control ID: 6b6e7c9118b03e94a97214b2c86e318e7fb0d3705f11e596e68dda914f98247c

Detections

Analytics

1.5.1 Ensure fs.protected_hardlinks is configured

Information

Solution

See Also

Item Details