Package "prelink" Must not be Installed
Ensures the prelink package is not installed, so file-integrity checking stays reliable.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
prelink rewrites ELF binaries and shared libraries to speed up dynamic linking, but doing so changes the on-disk hashes of those files. This breaks file-integrity tools like AIDE (and any checksum-based detection), masking unauthorized modifications. Prelinking can also amplify the damage of a vulnerability in a common library such as libc. Modern systems gain little from it, so the package should be removed.
What Pavois checks
Pavois checks the effective package state with package('prelink') and expects it absent (should_not be_installed), resolved through dpkg-query. This is more reliable than scanning config files: it confirms the binary truly is not present, regardless of leftover /etc/prelink.conf.d fragments.
describe package('prelink') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg-query -W -f='${Status}\n' prelink. Expected: a non-zero exit with no packages found matching prelink (or unknown ok not-installed). The command should not report install ok installed.
Inspect & investigate
Package removal is recorded in /var/log/dpkg.log (grep prelink /var/log/dpkg.log). After removal, AIDE runs (aide --check) should stop reporting spurious binary-hash changes.
Remediation
Pavois's harden plan removes the prelink package via the package resource (action: remove). It is applied with pavois harden apply. Best practice is to undo existing prelinking first with prelink -ua before the package is removed so binaries return to their normal state; after removal, rebaseline AIDE.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | prelink |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing prelink is low-risk on modern systems and improves integrity monitoring. The main caveat is binary state: if prelinking was already applied, removing the package without first running prelink -ua leaves binaries in a prelinked-but-unmanaged state. - Run prelink -ua before removal to restore original binaries. - Regenerate the AIDE database (aide --init) afterward so the new baseline reflects the un-prelinked files.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.5.4 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.