mediumkernelverified ✓rollback-safe
Enable kernel hardlink protection
kernel-hardlink-protect · RHEL ≥ 8 · 1 impl
Description
Kernel protection must be enabled to enforce DAC on hardlinks. This prevents hardlink-based attacks on privileged files.
Rationale
Hardlink protection prevents unprivileged users from creating hardlinks to files they cannot read, blocking data exfiltration.
Check → Remediate
Checksysctl_value
- key:
- fs.protected_hardlinks
- expected:
- 1
Remediatesysctl_set
- key:
- fs.protected_hardlinks
- value:
- 1
- persist_file:
- /etc/sysctl.d/99-kensa-hardlink.conf
Framework references
CIS
rhel8 1.5.2rhel10 1.5.2
STIG
V-257801 / RHEL-09-213030V-230268V-281309 / RHEL-10-701070
NIST 800-53
CM-6AC-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#kernel#sysctl#hardlink#dac