These actions should result with an error message: Permission denied. The directory,
/tmp, has permissions including the sticky bit. The error is a result of the kernel configuration for
To show the setting,
sysctl fs.protected_symlinks. This equals
1 when set. To disable temporarily, which is not recommended,
sysctl -w fs.protected_symlinks=0. To turn off permanently, which is again not recommended, use
See patchwork.kernel.org for more information.
To avoid link rot, the leading summary paragraphs on symbolic links from the hyperlink follow.
Kees Cook - July 2, 2012, 8:17 p.m.
This adds symlink and hardlink restrictions to the Linux VFS.
A long-standing class of security issues is the symlink-based
time-of-check-time-of-use race, most commonly seen in world-writable
directories like /tmp. The common method of exploitation of this flaw
is to cross privilege boundaries when following a given symlink (i.e. a
root process follows a symlink belonging to another user). For a likely
incomplete list of hundreds of examples across the years, please see:
The solution is to permit symlinks to only be followed when outside
a sticky world-writable directory, or when the uid of the symlink and
follower match, or when the directory owner matches the symlink's owner.