Details

Prelinking is a performance enhancing feature that decreases process start up time. It loads shared libraries into addresses for which the linking of required symbols has already been performed. After a binary has been prelinked, the addresses at which shared libraries is not changed, even if kernel.randomize_va_space is set to 1.

Rationale:

There is a bug in prelink that interferes with AIDE, the Linux file integrity checker. This has been fixed in RHEL6 (so prelink does not need to be disabled in RHEL6 systems).

Solution

Edit /etc/sysconfig/prelink and set PRELINKING=no:

PRELINKING=no

Note: If the feature is changed from yes to no, run /usr/sbin/prelink -ua to revert binaries and libraries to their original context before prelinking.

Default Value:

OS Default: No

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/3096

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.

References

• 800-53|CM-6
• CSCv7|5.1

Source

• Tenable.com/audits