Ensure fs.protected_symlinks is configured

FaibleNiveau 2Automatiséelinux

Description

fs.protected_symlinks controls how the kernel handles symbolic links. When enabled, symbolic links are followed only when outside a sticky world-writable directory, when the user identifier (UID) of the symlink and follower match, or when the directory owner matches the symlink's owner. More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.

Méthode de vérification

Méthode d'audit: Commande shell

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk fs.protected_symlinks 1; then echo compliant; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

1. Review all files being used by systemd sysctl and comment out or remove all fs.protected_symlinks lines that are not fs.protected_symlinks=1. Example script: #!/usr/bin/env bash { l_option="fs.protected_symlinks" l_value="1" l_grep="${l_option//./(\\.|\\/)}" a_files=() l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \ || readlink -e /usr/lib/systemd/systemd-sysctl)" a_files+=("/etc/sysctl.conf") while IFS= read -r l_fname; do l_file="$(readlink -e "${l_fname//# /}")" [ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \ <<< "${a_files[*]}" && a_files+=("$l_file") done < <("$l_systemdsysctl" --cat-config | tac | \ grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b') for l_file …

Propriétés

Systèmes d'exploitation: rocky-9
Étiquettes: cis-convertedkernellinuxsysctl
Référence: CIS Rocky Linux 9 Benchmark v3.0.0 - 1.5.2

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target linux --level 2