Remove prelink

Description

prelink modifies ELF binaries and shared libraries in place so that libraries load at fixed, precomputed addresses, to save a little time at program start. It is in the universe component of Ubuntu up to 24.04 and is no longer in the archive from 26.04.

On 26.04 the package cannot be installed from the archive, so the check passes unless it came from another source.

Rationale

Prelinked libraries always load at the same address, which removes part of the benefit of address space layout randomization (CB-UBU-BOOT-001). Prelink also rewrites binaries on a schedule, so file integrity tools such as AIDE report changes that are not attacks, which trains administrators to ignore their alerts. The startup gain is negligible on current hardware.

Impact

None known. Before removal, the fix runs prelink -ua to restore every binary to its original content, which can take a few minutes on a large system.

Setting

Audit

Run dpkg -s prelink. The package must not be installed.

Automated: every check must pass. Scanners report each check by its id.

package

The prelink package is not installed.

name: prelink
state: absent

Remediation

1. Restore the original binaries: prelink -ua.
2. Remove the package: apt purge prelink.

Rollback

Reinstall the package with apt install prelink; binaries are prelinked again at the next run of its daily job.

undo-and-purge

if command -v prelink >/dev/null 2>&1; then
  prelink -ua || { echo 'prelink -ua failed, package kept' >&2; exit 1; }
fi
DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=300 purge -y -q prelink

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• prelink(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• Ubuntu Security documentation - Address space layout randomization Canonical, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-UBU-BOOT-001 Enable full address space layout randomization

People and lifecycle