Enable Kernel Parameter to Enforce DAC on Regular files
Sets fs.protected_regular=2 so a process cannot create-open a regular file it does not own in a world/group-writable sticky directory, blocking file-spoofing races.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Available since Linux 4.19, fs.protected_regular=2 prohibits a process from opening, with the O_CREAT intent, a regular file it does not own inside a world- or group-writable sticky directory (such as /tmp). This defends against a file-spoofing race where an attacker pre-creates a regular file at the path a privileged program expects to create itself, hijacking the data the program writes. Enforcing DAC on these opens prevents writes to an attacker-controlled file.
What Pavois checks
Pavois reads the live kernel value via the kernel_parameter resource (equivalent to sysctl fs.protected_regular), not /etc/sysctl.conf or any *.conf drop-in. A value written to a file may never have been loaded (typo, ordering, an overriding drop-in); reading the running kernel reflects what is actually enforced.
describe kernel_parameter('fs.protected_regular') do
its('value') { should cmp 2 }
end
describe command("grep -hsE '^[[:space:]]*fs.protected_regular[[:space:]]*=[[:space:]]*2([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl fs.protected_regular, expected output fs.protected_regular = 2.
Inspect & investigate
Read the current value with sysctl fs.protected_regular or cat /proc/sys/fs/protected_regular. A blocked open returns EACCES to the caller without a kernel log entry; check the affected program's own logs.
Remediation
Pavois's harden plan sets the sysctl key fs.protected_regular to 2, persisting it to a managed drop-in and applying it live so the running kernel and future boots both use it. Applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | fs.protected_regular |
|---|---|
| resource | sysctl |
| value | 2 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Low risk on modern systems. It only affects create-opens of files you do not own in shared sticky directories; normal applications write to files they own or in their own directories. Rare software that shares pre-created files in /tmp across users could see EACCES, test such workflows before enforcing. Reversible by resetting the key to 0 or 1.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R14 | direct | 2.0 | high |
| NIST | AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.