From 62da505ea7588ac1e2be08d736011e7386e65eb7 Mon Sep 17 00:00:00 2001
From: Jorge Reyes <94730068+reyesj2@users.noreply.github.com>
Date: Thu, 27 Aug 2026 09:21:57 -0500
Subject: [PATCH] Revert "patch issue with fs.protected_symlinks"
---
salt/manager/tools/sbin/soup | 24 +-----------------------
salt/stig/enabled.sls | 9 ---------
salt/stig/files/sos-oscap.xml | 4 ++--
3 files changed, 3 insertions(+), 34 deletions(-)
diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup
index 94fb1305f..b6be60709 100755
--- a/salt/manager/tools/sbin/soup
+++ b/salt/manager/tools/sbin/soup
@@ -344,16 +344,6 @@ check_cluster_health() {
check_fleet_server() {
echo "Checking that Elastic Fleet Server is responding."
- # Before checking fleet health, check for and fix known issue with elastic-agent container and fs.protected_symlinks
- local protected_symlinks=$(sysctl -b fs.protected_symlinks)
- if [[ "$protected_symlinks" == "1" ]]; then
- # disable fs.protected_symlinks and restart elasticfleet
- sysctl -w fs.protected_symlinks=0
- docker stop so-elastic-fleet; docker rm -f so-elastic-fleet
- printf "\nUpdated sysctl fs.protected_symlinks. Restarting fleet before running health check and continuing with soup.\n"
- salt-call state.apply elasticfleet queue=True
- fi
-
# Modeled on the wait_for_so-elastic-fleet state check in elasticfleet/enabled.sls,
# which waits for HTTP 200 from the Fleet Server status API.
if curl -sk --fail --retry 3 --retry-delay 10 --max-time 30 "https://localhost:8220/api/status" > /dev/null 2>&1; then
@@ -1046,20 +1036,8 @@ post_to_3.2.0() {
}
### 3.2.0 End ###
-### 3.3.0 Scripts ###
-
- # Sets fs.protected_symlinks=0
- #
- # Elastic Agent docker image chowns its directory to the running UID
- # but does not chown the elastic-agent launcher symlink.
- # Preventing non-root users from following that launcher symlink.
-disable_sysctl_fs_protected_symlink() {
- salt -C 'I@stig:enabled' state.single sysctl.present name=fs.protected_symlinks value=0 config=/etc/sysctl.conf || true
-}
-
+### 3.2.0 Scripts ###
up_to_3.3.0() {
- disable_sysctl_fs_protected_symlink
-
INSTALLEDVERSION=3.3.0
}
diff --git a/salt/stig/enabled.sls b/salt/stig/enabled.sls
index b53256e04..91aae7069 100644
--- a/salt/stig/enabled.sls
+++ b/salt/stig/enabled.sls
@@ -65,15 +65,6 @@ run_remediate:
- success_retcodes:
- 2
-# Elastic Agent docker image chowns its directory to the running UID but does not
-# chown the elastic-agent launcher symlink. fs.protected_symlinks=1 then prevents
-# non-root users from following that launcher symlink.
-{# OSCAP rule id: xccdf_org.ssgproject.content_rule_sysctl_fs_protected_symlinks #}
-fs.protected_symlinks:
- sysctl.present:
- - value: 0
- - config: /etc/sysctl.conf
-
{# OSCAP rule id: xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction #}
disable_ctrl_alt_del_action:
file.replace:
diff --git a/salt/stig/files/sos-oscap.xml b/salt/stig/files/sos-oscap.xml
index 9fc8dacf8..aa5b2ed31 100644
--- a/salt/stig/files/sos-oscap.xml
+++ b/salt/stig/files/sos-oscap.xml
@@ -1601,7 +1601,7 @@ DISA STIG for Oracle Linux 9 V1R3.
-
+
@@ -2202,7 +2202,7 @@ standard DISA STIG for Oracle Linux 9 profile.
-
+