Processes that create files in shared directories often assume they are creating a new object. An attacker can pre-create a FIFO or regular file with the same name and influence the open. Linux exposes fs.protected_fifos and fs.protected_regular to reduce this class of problem in sticky directories. The settings are useful, but they do not make an unsafe path algorithm safe.

The kernel documentation describes the intent of these protections as avoiding unintended writes to attacker-controlled FIFOs and regular files when a program expected to create its own object. A value of 0 leaves writes unrestricted. A value of 1 blocks O_CREAT opens on objects not owned by the caller in world-writable sticky directories, unless the directory owner owns the object. A value of 2 extends that rule to group-writable sticky directories.

What the kernel protects

This protection applies to specific ownership and directory conditions. It is not a complete defense for every symlink, hardlink, arbitrary path, or directory writable by an untrusted group outside the covered pattern. The related protected_symlinks and protected_hardlinks settings address different link behaviors. Treat the sysctls as layers in the kernel's shared-directory policy, not as a replacement for private working directories.

Where it applies

Review the programs that run with more privilege than the users who can write to their working directories. Cron jobs, mail filters, log processors, backup scripts, and service helpers are common examples. Look for O_CREAT paths that include a predictable name, especially under /tmp or another shared sticky directory. Check whether the program verifies ownership and file type after opening, and whether it uses O_NOFOLLOW or a directory file descriptor where the language supports them.

Review method

Useful checks include:

  • Record the current fs.protected_fifos, fs.protected_regular, and related sysctl values.

  • Identify shared writable directories used by privileged jobs.

  • Search for predictable temporary filenames and shell redirections.

  • Test with pre-created regular files and FIFOs owned by an unprivileged user.

  • Confirm that failure is explicit rather than a fallback to another writable path.

Persistent configuration

The sysctl value should also be tested at boot and after configuration restoration. A setting applied manually can disappear during an image rebuild or a host migration. Configuration management should record the intended value, the supporting kernel version, and any exception. Do not assume a hardened default from one distribution applies to every host in the fleet.

Finally, prefer application-level safe creation. A private directory, a random filename created with exclusive semantics, and an ownership check are easier to reason about than a global flag whose exact effect depends on directory mode and ownership. The kernel protection is a valuable backstop when a legacy program cannot be changed, but the program still owns the decision about which path it trusts.

References

  • Linux kernel /proc/sys/fs documentation, protected_fifos and protected_regular: https://docs.kernel.org/admin-guide/sysctl/fs.html