Ensure fs.protected_symlinks is configured

BajaNivel 2Automatizadalinux

Descripción

fs.protected_symlinks controls how the kernel handles symbolic links. When enabled, symbolic links are followed only when outside a sticky world-writable directory, when the user identifier (UID) of the symlink and follower match, or when the directory owner matches the symlink's owner. More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.

Cómo se verifica

Método de auditoría: Comando de shell

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk fs.protected_symlinks 1; then echo compliant; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Review all files being used by systemd sysctl and comment out or remove all fs.protected_symlinks lines that are not fs.protected_symlinks=1. Example script: #!/usr/bin/env bash { l_option="fs.protected_symlinks" l_value="1" l_grep="${l_option//./(\\.|\\/)}" a_files=() l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \ || readlink -e /usr/lib/systemd/systemd-sysctl)" a_files+=("/etc/sysctl.conf") while IFS= read -r l_fname; do l_file="$(readlink -e "${l_fname//# /}")" [ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \ <<< "${a_files[*]}" && a_files+=("$l_file") done < <("$l_systemdsysctl" --cat-config | tac | \ grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b') for l_file …

Propiedades

Sistemas operativos: rocky-9
Etiquetas: cis-convertedkernellinuxsysctl
Referencia: CIS Rocky Linux 9 Benchmark v3.0.0 - 1.5.2

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target linux --level 2