Enable Kernel Parameter to Enforce DAC on FIFOs
Sets fs.protected_fifos=2 so a process cannot open a FIFO it does not own in a world/group-writable sticky directory, blocking FIFO-spoofing attacks.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Available since Linux 4.19, fs.protected_fifos=2 prohibits opening FIFOs (named pipes) that the caller does not own inside world- or group-writable sticky directories (such as /tmp). This blocks a class of FIFO-spoofing attacks where an attacker pre-creates a named pipe at a path a privileged program expects to be a fresh regular file, redirecting or stalling its writes. Enforcing discretionary access control (DAC) on FIFO opens prevents unintentional writes to an attacker-controlled pipe.
What Pavois checks
Pavois reads the live kernel value via the kernel_parameter resource (equivalent to sysctl fs.protected_fifos), not the contents of /etc/sysctl.conf or any *.conf drop-in. A file can declare a value that was never loaded (typo, ordering, a later drop-in overriding it, or a module not yet applied); reading the running kernel reflects what is actually enforced right now.
describe kernel_parameter('fs.protected_fifos') do
its('value') { should cmp 2 }
end
describe command("grep -hsE '^[[:space:]]*fs.protected_fifos[[:space:]]*=[[:space:]]*2([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl fs.protected_fifos, expected output fs.protected_fifos = 2.
Inspect & investigate
Read the current value with sysctl fs.protected_fifos or cat /proc/sys/fs/protected_fifos. When the protection blocks an open, the kernel does not log by default, but the calling program receives EACCES; check that application's own error log.
Remediation
Pavois's harden plan sets the sysctl key fs.protected_fifos to 2, writing it to a managed drop-in and applying it live so both the running kernel and subsequent boots use the value. Applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | fs.protected_fifos |
|---|---|
| resource | sysctl |
| value | 2 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Very low risk on modern systems. It only affects opening FIFOs you do not own in shared sticky directories, legitimate apps create their FIFOs in their own directories or own the pipe. Rare legacy software using shared named pipes in /tmp could see EACCES; test such applications before enforcing. The change is reversible by resetting the key to 0 or 1.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R14 | direct | 2.0 | high |
| NIST | AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.