Protect symbolic links in world-writable sticky directories

Description

With fs.protected_symlinks = 1, the kernel only follows a symbolic link located in a world-writable sticky directory (such as /tmp) when the process following it owns the link, or when the link owner also owns the directory.

Debian enables it by default: through /usr/lib/sysctl.d/99-protect-links.conf (procps) on Debian 12, and through /usr/lib/sysctl.d/50-default.conf (linux-sysctl-defaults) on Debian 13.

Rationale

A classic attack plants a symbolic link in /tmp with the name a privileged program is about to create, pointing to a sensitive file. When the program writes "its" file, it overwrites the target instead. This setting blocks the whole class of time-of-check to time-of-use races based on symlinks in shared directories.

Impact

None known for normal use. Programs that rely on following other users' symlinks in /tmp are rare and already unsafe.

Setting

Audit

Run sysctl fs.protected_symlinks. The value must be 1. Then check that no sysctl configuration file sets it to 0.

Automated: every check must pass. Scanners report each check by its id.

running

Running value of fs.protected_symlinks.

key: fs.protected_symlinks
value: 1

Remediation

Create /etc/sysctl.d/60-cirsec.conf containing fs.protected_symlinks = 1, remove any other assignment of this key, then run sysctl --system.

Rollback

Remove the line from /etc/sysctl.d/60-cirsec.conf and run sysctl --system.

set

Generated from check running: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• Linux kernel documentation - Documentation for /proc/sys/fs/ (protected_symlinks) The Linux Kernel Organization, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R14) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle