Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure links are protected #159

Closed
cmhe opened this issue Sep 14, 2021 · 0 comments · Fixed by #160
Closed

Ensure links are protected #159

cmhe opened this issue Sep 14, 2021 · 0 comments · Fixed by #160

Comments

@cmhe
Copy link
Contributor

cmhe commented Sep 14, 2021

Is your feature request related to a problem? Please describe.
Currently linux-baseline does not check if link protection is enabled.

Describe the solution you'd like
Create a additional check for those sysctls:

  • fs.protected_fifos == 1 or 2
  • fs.protected_hardlinks == 1
  • fs.protected_regular == 2
  • fs.protected_symlinks == 1

Additional context
Unprotected symlinks are a long-standing cause for security issues. See the official kernel docs about this.

Those settings should be default on most current Linux distributions, but it still makes sense to check those. Other security check projects like Lynis already checks those as well. See here

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant