Protect shared folders from link and file tricks

Why it matters

In a shared folder like /tmp, anyone can create files. An attacker can plant a link there that points at something important, such as a file in your home folder, and wait for a script or privileged program to write to the usual name. The program follows the link and overwrites the target.

How it works

Turns on four kernel protections: fs.protected_symlinks=1 and fs.protected_hardlinks=1 limit following and creating links in sticky world-writable directories, and fs.protected_fifos=2 and fs.protected_regular=2 stop programs from opening, with create, a pipe or file owned by someone else in such folders.

Who should use it

Suitable for everyone. Many systems already enable most of these. Leave them off only if a legacy script depends on reusing files that another user created in /tmp.

What you may notice

Usually nothing. A script that writes to a file in /tmp created by a different user may fail with Permission denied.

Check it on your computer

Read the current value:

sysctl fs.protected_symlinks
sysctl fs.protected_hardlinks
sysctl fs.protected_fifos
sysctl fs.protected_regular

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w fs.protected_symlinks=1
sudo sysctl -w fs.protected_hardlinks=1
sudo sysctl -w fs.protected_fifos=2
sudo sysctl -w fs.protected_regular=2

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-fs-protected-files.conf <<'EOF'
fs.protected_symlinks = 1
fs.protected_hardlinks = 1
fs.protected_fifos = 2
fs.protected_regular = 2
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Do not run programs from /tmp

Sources

Linux Hardening Guide (madaidans)

2.2.3

Linux kernel documentation

fs.protected_symlinks