Enable Kernel Parameter to Enforce DAC on Hardlinks
Sets fs.protected_hardlinks=1 so users can only hard-link files they own or can read/write, blocking hardlink-based privilege-escalation tricks.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
With fs.protected_hardlinks=1, a user may create a hard link to a file only if they own the source file or already have read and write access to it. Without this protection, an unprivileged user can hard-link a sensitive file (one they cannot read) into a writable directory and trick a privileged program into following it, a classic TOCTOU / hardlink exploitation vector against unsafe use of open() or creat(). Enforcing DAC on hardlink creation closes this avenue.
What Pavois checks
Pavois reads the live kernel value via the kernel_parameter resource (equivalent to sysctl fs.protected_hardlinks), not /etc/sysctl.conf or any *.conf drop-in. A configured file may never have been applied (typo, load ordering, an overriding drop-in); reading the running kernel shows what is actually enforced.
describe kernel_parameter('fs.protected_hardlinks') do
its('value') { should cmp 1 }
end
describe command("grep -hsE '^[[:space:]]*fs.protected_hardlinks[[:space:]]*=[[:space:]]*1([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl fs.protected_hardlinks, expected output fs.protected_hardlinks = 1.
Inspect & investigate
Read the current value with sysctl fs.protected_hardlinks or cat /proc/sys/fs/protected_hardlinks. A denied hardlink creation returns EPERM to the calling program rather than producing a kernel log line; check that program's error output.
Remediation
Pavois's harden plan sets the sysctl key fs.protected_hardlinks to 1, persisting it to a managed drop-in and applying it live so the running kernel and future boots both use it. Applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | fs.protected_hardlinks |
|---|---|
| resource | sysctl |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Negligible risk; this is enabled by default on most modern distributions. Well-behaved software hard-links only files it owns. A few backup or packaging tools that hardlink across ownership boundaries could see EPERM; test them if used. Reversible by resetting the key to 0.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R14 | direct | 2.0 | high |
| NIST | AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| CIS | 1.5.2 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.