Description
With fs.protected_hardlinks = 1, a user can only create a hard link to a file they own, or
to a file they can both read and write. Linking to other files needs the CAP_FOWNER capability.
Debian enables it by default: through /usr/lib/sysctl.d/99-protect-links.conf (procps) on
Debian 12, and through /usr/lib/sysctl.d/50-default.conf (linux-sysctl-defaults) on Debian 13.
Rationale
Hard links to files owned by other users enable races similar to symlink attacks. They also let an attacker keep a copy of a vulnerable setuid binary that survives its replacement by a package update, and exploit it later.
Impact
None known for normal use. Tools that hard link files they do not own (some backup or deduplication tools run as a regular user) must run with the needed privileges.
Setting
| Location | sysctl `fs.protected_hardlinks`, persisted in `/etc/sysctl.d/` |
| Default | 1 |
| Recommended | 1 |
Audit
Run sysctl fs.protected_hardlinks. The value must be 1.
Then check that no sysctl configuration file sets it to 0.
Automated: every check must pass. Scanners report each check by its id.
running
Running value of fs.protected_hardlinks.
key: fs.protected_hardlinks
value: 1
Remediation
Create /etc/sysctl.d/60-cirsec.conf containing fs.protected_hardlinks = 1,
remove any other assignment of this key, then run sysctl --system.
| Restart | none |
| Disruption | none |
Rollback
Remove the line from /etc/sysctl.d/60-cirsec.conf and run sysctl --system.
set
Generated from check running: the engine writes the fix for every output, it sets the expected value and the check runs again after.
Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.
References
- Linux kernel documentation - Documentation for /proc/sys/fs/ (protected_hardlinks) The Linux Kernel Organization, vendor-doc, accessed 2026-10-18
- ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R14) ANSSI, guide, accessed 2026-10-18
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0 | R14 | partial | R14 lists several filesystem settings; this control covers fs.protected_hardlinks. |
| NIST SP 800-53 Rev. 55.1.1 | AC-6 | related |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
People and lifecycle
| Authors |
|
| Verified | 2026-10-18 by Sn0wAlice on 12, Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64. Generated check, fix and check again for profiles core and server-hardened; values kept after reboot; fix idempotent. |
| Verified | 2026-10-18 by Sn0wAlice on 13, Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64. Generated check, fix and check again for profiles core and server-hardened; values kept after reboot; fix idempotent. |
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-18, 2026-10-18 |
| Translations | fr |