mediumkernelverified ✓rollback-safe
Enable kernel symlink protection
kernel-symlink-protect · RHEL ≥ 8 · 1 impl
Description
Kernel protection must be enabled to enforce DAC on symlinks. This prevents symlink-based attacks on privileged files.
Rationale
Symlink protection prevents unprivileged users from exploiting race conditions in world-writable directories like /tmp.
Check → Remediate
Checksysctl_value
- key:
- fs.protected_symlinks
- expected:
- 1
Remediatesysctl_set
- key:
- fs.protected_symlinks
- value:
- 1
- persist_file:
- /etc/sysctl.d/99-kensa-symlink.conf
Framework references
CIS
rhel8 1.5.3rhel10 1.5.3
STIG
V-257802 / RHEL-09-213035V-230267V-281310 / RHEL-10-701080
NIST 800-53
CM-6AC-6
Live verification
rhel10:checkrhel8:checkrhel9:check
#kernel#sysctl#symlink#dac