Linux-based systems are vulnerable to symlink race attacks from unprivileged UID processes. For example, a PHP process on a shared hosting can create a symlink to /etc/passwd in a directory where Apache httpd will serve it to anybody on the Internet. For other examples of symlink-related issues, see
I'd like some way to protect all Linux systems (of various versions) from those suspect processes creating malicious symlinks.
There are some partial solutions out there, but usually they involve custom patching of the Linux kernel (which is a lot of work and a drag on update process) or they are not sufficiently restrictive. There is Kees Cook's patch to Linux in versions 3.6 and higher
but it is not present in all earlier Linux versions and it protects only from some symlink issues, not necessarily all of them (such as creating symlinks in non-sticky bit directories, which is still a problem).
What are some universal solutions to symlink race vulnerabilities applicable to all common Linux systems, from version 2.6.26 on?
One thing that comes to mind is setting up a global rule that prevents high UID users from ever creating a symlink. For some deployments (shared hosting), such restriction may be acceptable.
What is the easiest way to ban users from creating symlinks on systems with Linux kernel >=2.6.26? (symlinks however need to be supported for more privileged users, including root)
Which of these: SELinux, Seccomp-bpf, Apparmor is best suited for setting up such a restriction?