<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 11/30/13, 11:35 AM, Dave Smith
      wrote:<br>
    </div>
    <blockquote cite="mid:529A13EE.9050105@scapsecurityguides.org"
      type="cite">
      <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
      <div class="moz-cite-prefix">This looks great, please push!<br>
        <br>
        On 11/27/2013 10:40 AM, Jan Lieskovsky wrote:<br>
      </div>
      <blockquote
        cite="mid:713840356.9158997.1385566829539.JavaMail.root@redhat.com"
        type="cite">
        <pre wrap="">Proposal for the "2.1.3.1.b. Disable Prelinking"
rule remediation.

Please review.

Thank you &amp;&amp; Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team</pre>
        <blockquote type="cite"><br>
          <fieldset class="mimeAttachmentHeader"><legend
              class="mimeAttachmentHeaderName">0001-RHEL6-Add-remediation-for-Disable-Prelinking-rule.patch</legend></fieldset>
          <br>
          <div class="moz-text-plain" wrap="true" graphical-quote="true"
            style="font-family: -moz-fixed; font-size: 12px;"
            lang="x-western">
            <pre wrap="">From 102d335388c881e6f825b48c54e33f0e1e623767 Mon Sep 17 00:00:00 2001
From: Jan Lieskovsky <a class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
Date: Wed, 27 Nov 2013 16:36:04 +0100
Subject: [PATCH] [RHEL6] Add remediation for Disable Prelinking rule

Signed-off-by: Jan Lieskovsky <a class="moz-txt-link-rfc2396E" href="mailto:jlieskov@redhat.com">&lt;jlieskov@redhat.com&gt;</a>
---
 RHEL6/input/fixes/bash/disable_prelink.sh | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 RHEL6/input/fixes/bash/disable_prelink.sh

diff --git a/RHEL6/input/fixes/bash/disable_prelink.sh b/RHEL6/input/fixes/bash/disable_prelink.sh
new file mode 100644
index 0000000..98dc85d
--- /dev/null
+++ b/RHEL6/input/fixes/bash/disable_prelink.sh
@@ -0,0 +1,9 @@
+#
+# Disable prelinking altogether
+#
+sed -i "s/PRELINKING.*/PRELINKING=no/g" /etc/sysconfig/prelink
+
+#
+# Undo previous prelink changes to binaries
+#
+/usr/sbin/prelink -ua
<div class="moz-txt-sig">-- 
1.8.3.1

</div></pre>
          </div>
        </blockquote>
      </blockquote>
    </blockquote>
    <br>
    <br>
    What if PRELINK was commented out? e.g.<br>
    <br>
    # grep PRELINKING /etc/sysconfig/prelink<br>
    #PRELINKING=commented<br>
    [root@SSG-RHEL6 shared]# sed -i "s/PRELINKING.*/PRELINKING=no/g"
    /etc/sysconfig/prelink<br>
    [root@SSG-RHEL6 shared]# grep PRELINKING /etc/sysconfig/prelink<br>
    #PRELINKING=no<br>
    <br>
    <br>
    That's why the sysctl (+others) use something like:<br>
    <br>
    if grep --silent ^PRELINKING /etc/sysconfig/prelink ; then<br>
           sed -i 's/^PRELINKING.*/PRELINKING=no/g'
    /etc/sysconfig/prelink<br>
    else<br>
           echo "" &gt;&gt; /etc/sysconfig/prelink<br>
           echo "# Set PRELINKING=no per security requirements" &gt;&gt;
    /etc/sysconfig/prelink<br>
           echo "PRELINKING=no" &gt;&gt; /etc/sysconfig/prelink
  </body>
</html>