Enable Kernel Parameter to Enforce DAC on Symlinks
Sets fs.protected_symlinks=1 so symlinks in world-writable sticky directories are followed only when owner constraints match, blocking symlink-following races.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
With fs.protected_symlinks=1, the kernel follows a symbolic link in a world-writable sticky directory only when the link's owner matches the follower, or the link and directory owners match. This blocks the classic symlink-following race where an attacker plants a symlink in /tmp pointing at a sensitive file so that a privileged program writes through it. Enforcing DAC on symlink resolution closes an exploitation vector against unsafe use of open() or creat().
What Pavois checks
Pavois reads the live kernel value via the kernel_parameter resource (equivalent to sysctl fs.protected_symlinks), not /etc/sysctl.conf or any *.conf drop-in. A configured file may never have been applied (typo, load ordering, an overriding drop-in); reading the running kernel shows what is actually enforced.
describe kernel_parameter('fs.protected_symlinks') do
its('value') { should cmp 1 }
end
describe command("grep -hsE '^[[:space:]]*fs.protected_symlinks[[:space:]]*=[[:space:]]*1([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl fs.protected_symlinks, expected output fs.protected_symlinks = 1.
Inspect & investigate
Read the current value with sysctl fs.protected_symlinks or cat /proc/sys/fs/protected_symlinks. A blocked symlink follow returns EACCES to the caller; the kernel does not log it by default, so inspect the affected program's error output.
Remediation
Pavois's harden plan sets the sysctl key fs.protected_symlinks to 1, persisting it to a managed drop-in and applying it live so the running kernel and future boots both use it. Applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | fs.protected_symlinks |
|---|---|
| resource | sysctl |
| value | 1 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Negligible risk; enabled by default on most modern distributions. Normal software is unaffected because it does not rely on following other users' symlinks in shared directories. Reversible by resetting the key to 0.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R14 | direct | 2.0 | high |
| NIST | AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| CIS | 1.5.3 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.