Ensure fs.protected_symlinks is configured

低等級 2自動化linux

說明

fs.protected_symlinks controls how the kernel handles symbolic links. When enabled, symbolic links are followed only when outside a sticky world-writable directory, when the user identifier (UID) of the symlink and follower match, or when the directory owner matches the symlink's owner. More information about the kernel parameter configuration files, their location, and load preference is available in the section overview.

檢查方式

稽核方法: Shell 指令

shell

chk() { p=$1; allowed=" $2 "; case $p in net.ipv6.*) [ -d /proc/sys/net/ipv6 ] || return 0;; esac; v=$(sysctl -n "$p" 2>/dev/null) || { echo "$p: not available"; return 1; }; case "$allowed" in *" $v "*) ;; *) echo "$p is $v (running)"; return 1;; esac; sd=$(readlink -e /lib/systemd/systemd-sysctl || readlink -e /usr/lib/systemd/systemd-sysctl); f=$("$sd" --cat-config 2>/dev/null | grep -Po "^\h*${p//./\.}\h*=\h*\K\H+" | tail -n1); [ -n "$f" ] || { echo "$p is not set in any sysctl configuration file"; return 1; }; case "$allowed" in *" $f "*) ;; *) echo "$p is $f in configuration"; return 1;; esac; }; if chk fs.protected_symlinks 1; then echo compliant; fi

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

1. Review all files being used by systemd sysctl and comment out or remove all fs.protected_symlinks lines that are not fs.protected_symlinks=1. Example script: #!/usr/bin/env bash { l_option="fs.protected_symlinks" l_value="1" l_grep="${l_option//./(\\.|\\/)}" a_files=() l_systemdsysctl="$(readlink -e /lib/systemd/systemd-sysctl \ || readlink -e /usr/lib/systemd/systemd-sysctl)" a_files+=("/etc/sysctl.conf") while IFS= read -r l_fname; do l_file="$(readlink -e "${l_fname//# /}")" [ -n "$l_file" ] && ! grep -Psiq -- '(^|\h+)'"$l_file"'\b' \ <<< "${a_files[*]}" && a_files+=("$l_file") done < <("$l_systemdsysctl" --cat-config | tac | \ grep -Psio -- '^\h*#\h*\/[^#\n\r\h]+\.conf\b') for l_file …

屬性

作業系統: rocky-9
標籤: cis-convertedkernellinuxsysctl
參考資料: CIS Rocky Linux 9 Benchmark v3.0.0 - 1.5.2

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target linux --level 2