Protect hard links to files the user does not own

Description

With fs.protected_hardlinks = 1, a user can only create a hard link to a file they own, or to a file they can both read and write. Linking to other files needs the CAP_FOWNER capability.

Ubuntu enables it by default, through /usr/lib/sysctl.d/99-protect-links.conf (procps) or /usr/lib/sysctl.d/50-default.conf (systemd), and /etc/sysctl.d/10-link-restrictions.conf on 20.04.

Rationale

Hard links to files owned by other users enable races similar to symlink attacks. They also let an attacker keep a copy of a vulnerable setuid binary that survives its replacement by a package update, and exploit it later.

Impact

None known for normal use. Tools that hard link files they do not own (some backup or deduplication tools run as a regular user) must run with the needed privileges.

Setting

Audit

Run sysctl fs.protected_hardlinks. The value must be 1. Then check that no sysctl configuration file sets it to 0.

Automated: every check must pass. Scanners report each check by its id.

running

Running value of fs.protected_hardlinks.

key: fs.protected_hardlinks
value: 1

Remediation

Create /etc/sysctl.d/60-cirsec.conf containing fs.protected_hardlinks = 1, remove any other assignment of this key, then run sysctl --system.

Rollback

Remove the line from /etc/sysctl.d/60-cirsec.conf and run sysctl --system.

set

Generated from check running: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• Ubuntu Security documentation - File handling Canonical, vendor-doc, accessed 2026-10-19
• Linux kernel documentation - Documentation for /proc/sys/fs/ (protected_hardlinks) The Linux Kernel Organization, vendor-doc, accessed 2026-10-19
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R14) ANSSI, guide, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle