0074-prelink-disable - Prelink Installed¶

Rule ID¶

• 0074-prelink-disable

Category¶

• system

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• prelink is a program that modifies ELF shared libraries and ELF dynamically linked binaries, so that the dynamic linker requires significantly less time to perform relocations at startup.

Scan Frequency¶

• 1 */5 * * *

Rationale¶

• The prelink feature may interfere with AIDE operations because it changes binary files. If a malicious user is able to compromise common libraries such as libc, prelink also increases the system's vulnerability.

Risk Items¶

• Service Unavailable

Audit Method¶

• Verify that prelink is not installed. Run the following command:

 # rpm -q prelink
package prelink is not installed

Remediation¶

• Run the following command to restore the binaries to their original state:

# prelink -ua

yum remove prelink

Impact¶

• None

Default Value¶

• None

References¶

• None

CIS Controls¶

• Version 7

  14.9 Enforce Detailed Logging for Access or Changes to Sensitive Data Enforce detailed audit logging for access to sensitive data or changes to sensitive data (using tools such as file integrity monitoring or security information and event monitoring).