1.5.2 Ensure fs.protected_symlinks is configured

Information

fs.protected_symlinks Controls how the kernel handles symbolic links.

More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.

Disallowing symlinks mitigates vulnerabilities based on unsecure file systems accessed by privileged programs. This reduces the risk of an exploitation vector exploiting unsafe use of open or creat.

Solution

- Review all files being used by systemd-sysctl and comment out or remove all fs.protected_symlinks lines that are not fs.protected_symlinks=1.

Example script:

#!/usr/bin/env bash

{
l_option=\"fs.protected_symlinks\" l_value=\"1\"
l_grep=\"${l_option//./(\\.|\\/)}\" a_files=()
l_systemdsysctl=\"$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)\"
l_ufw_file=\"$([ -f /etc/default/ufw ] && \
awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)\"
[ -f \"$(readlink -e \"$l_ufw_file\")\" ] && \
a_files+=(\"$l_ufw_file\"); a_files+=(\"/etc/sysctl.conf\")
while IFS= read -r l_fname; do
l_file=\"$(readlink -e \"${l_fname//# /}\")\"
[ -n \"$l_file\" ] && ! grep -Psiq -- '(^|\h+)'\"$l_file\"'\b' \
<<< \"${a_files[*]}\" && a_files+=(\"$l_file\")
done < <(\"$l_systemdsysctl\" --cat-config | tac | \
grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in \"${a_files[@]}\"; do
grep -Psio -- '\h*'\"$l_grep\"'\h*=\h*\H+\b' \"$l_file\" \
| grep -Psivq -- '^\h*'\"$l_grep\"'\h*=\h*'\"$l_value\"'\b' && \
sed -ri '/^\s*'\"$l_grep\"'\s*=\s*(0|[2-9]|1[0-9]+)/s/^/# /' \"$l_file\"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:

fs.protected_symlinks = 1

Example:

# [ ! -d \"/etc/sysctl.d/\" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' \"\" \"fs.protected_symlinks = 1\" >> /etc/sysctl.d/60-fs_sysctl.conf

Note: If the UFW file was the first file listed in the audit, the entry will be commented out as part of the first step, however updating Uncomplicated Firewall (UFW) may update this change. In this case the updated entry will supersede the entry being created as part of this step.

- Run the following command to load all sysctl configuration files:

# sysctl --system

Impact:

By enabling the fs.protected_symlinks kernel parameter, symbolic links are permitted to be followed only when outside a sticky world-writable directory, or when the user identifier (UID) of the link and follower match, or when the directory owner matches the symlink's owner.

Item Details

Audit Name: CIS Debian Linux 13 v1.0.0 L2 Workstation

Category: ACCESS CONTROL

Plugin: Unix

Control ID: b0139de6931b23eedc6359f43c1f1656bc83671f6643d6e526f7a559c03d0a23

Detections

Analytics

1.5.2 Ensure fs.protected_symlinks is configured

Information

Solution

See Also

Item Details