1.5.2 Ensure fs.protected_hardlinks is configured

Information

fs.protected_hardlinks Controls the creation of hard links to files.

By enabling the fs.protected_hardlinks kernel parameter, users can no longer create soft or hard links to files they do not own.

Disallowing hardlinks mitigates vulnerabilities based on unsecure file systems accessed by privileged programs. This reduces the risk of an exploitation vector exploiting unsafe use of open or creat.

Solution

- Review all files being used by systemd sysctl and comment out or remove all fs.protected_hardlinks lines that are not fs.protected_hardlinks=1.

Example script:

#!/usr/bin/env bash

{
l_option="fs.protected_hardlinks" l_value="1"
l_grep="${l_option//./(\\.|\\/)}" a_files=()
l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \
|| readlink -e /usr/lib/systemd/systemd-sysctl)"
l_ufw_file="$([ -f /etc/default/ufw ] && \
awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)"
[ -f "$(readlink -e "$l_ufw_file")" ] && \
a_files+=("$l_ufw_file"); a_files+=("/etc/sysctl.conf")
while IFS= read -r l_fname; do
l_file="$(readlink -e "${l_fname//# /}")"
[ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \
<<< "${a_files[*]}" && a_files+=("$l_file")
done < <("$l_systemdsysctl" --cat-config | tac | \
grep -Pio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b')
for l_file in "${a_files[@]}"; do
grep -Poi -- '\h*'"$l_grep"'\h*=\h*\H+\b' "$l_file" \
| grep -Pivq -- '^\h*'"$l_grep"'\h*=\h*'"$l_value"'\b' && \
sed -ri '/^\s*'"$l_grep"'\s*=\s*(0|[2-9]|1[0-9]+)/s/^/# /' "$l_file"
done
}
- Create or edit a file in the /etc/sysctl.d/ directory ending in .conf and edit or add the following line:

fs.protected_hardlinks = 1

Example:

# [ ! -d "/etc/sysctl.d/" ] && mkdir -p /etc/sysctl.d/
# printf '%s\n' "" "fs.protected_hardlinks = 1" >> /etc/sysctl.d/60-fs_sysctl.conf

Note: If the UFW file was the first file listed in the audit, the entry will be commented out as part of the first step, however updating Uncomplicated Firewall (UFW) may update this change. In this case the updated entry will supersede the entry being created as part of this step.

- Run the following command to load all sysctl configuration filles:

# sysctl --system

Item Details

Audit Name: CIS Rocky Linux 10 v1.0.0 L1 Server

Category: ACCESS CONTROL

Plugin: Unix

Control ID: c41abf3b3fa2727748e55d3460c726c8717780e2c3ba9a4d7c53f28fe96e4187

Detections

Analytics

1.5.2 Ensure fs.protected_hardlinks is configured

Information

Solution

See Also

Item Details