Filesystem Hardening¶
Shared directories like /tmp are writable by everyone, and that's where a whole family of attacks lives: leave a symlink where root will write, or a FIFO where root will read. The fs.protected_* switches close those off, and fs.suid_dumpable keeps privileged programs from writing their memory to disk.
The values¶
| Setting | Value | Why |
|---|---|---|
fs.protected_symlinks |
1 | In a world-writable sticky directory (/tmp), a symlink is only followed if its owner matches the follower or the directory owner. Blocks the classic "root writes through my symlink to /etc/passwd" trick. |
fs.protected_hardlinks |
1 | A user can only hardlink files they own or can write. Otherwise a user can hardlink /etc/shadow into /tmp and wait for a program to change its permissions. |
fs.protected_fifos |
2 | In sticky world-writable directories, don't open FIFOs the caller doesn't own (2 covers group-writable too) |
fs.protected_regular |
1 or 2 | Same for regular files: a program that opens /tmp/x with O_CREAT won't be tricked into writing to a file someone else placed there |
fs.suid_dumpable (CIS 1.5.3) |
0 | A setuid program that crashes doesn't write a core dump, which would contain whatever privileged data it held (password hashes, keys) |
Apply¶
Same method as the Kernel Hardening page: a file under /etc/sysctl.d/, one key = value per line from the table, then sudo sysctl --system and watch each key echo back.
sudo nano /etc/sysctl.d/60-fs-hardening.conf
sudo sysctl --system
Core dumps in general are rarely wanted on a hardened machine; the * hard core 0 limit (CIS 1.5.4) is on the Kernel Hardening page, and ProcessSizeMax=0 in /etc/systemd/coredump.conf does the same for systemd's collector.
Verify¶
sysctl fs.protected_symlinks fs.protected_hardlinks fs.protected_fifos fs.protected_regular fs.suid_dumpable
Example¶
sysctl fs.suid_dumpable returns 2, meaning every crashed setuid program leaves a readable dump in /var/crash or the working directory. ls /var/crash shows _usr_bin_sudo.0.crash. Set the values above, and delete the dump.
Try it¶
- With
protected_symlinksat 0, create a symlink in/tmpas one user pointing at a file owned by another and try to write through it as the second user. Set it to 1 and try again. - Run a setuid program in a way that crashes and see whether a core file appears.
Build it¶
Add the fs keys to sysctl-check.sh.