SecureLinks — Simuzo Docs

Overview

SecureLinks is a kernel module (simuzo_securelinks) that blocks unprivileged users from following symbolic links they do not own. Enforcement is kernel-only — LD_PRELOAD does not implement SecureLinks.

Policy summary A symlink follow is denied when the process eUID is ≥ min_user_uid (default 1000), the process lacks CAP_DAC_OVERRIDE, and the symlink owner is neither root nor the process owner (with additional userns rules for rootless Podman).

How the Module Is Obtained

Mirror download (preferred) — prebuilt .ko for your exact uname -r from the Softaculous mirror, saved as /var/simuzo/securelinks.ko
Local build — compile from source when no prebuilt match exists (requires matching kernel-devel / linux-headers)

CLI Management

# Status / config / mirror
simuzo --securelinks status

# Fetch prebuilt module for this kernel
simuzo --securelinks download

# Compile from source
simuzo --securelinks build

# Load / unload
simuzo --securelinks load
simuzo --securelinks unload

# Persist enable/disable in config and load/apply
simuzo --securelinks enable
simuzo --securelinks disable

# Apply sysctls + ensure module load (same as onboot path)
simuzo --securelinks apply

Configuration Flag

Controlled by $globals['securelinks_kmod'] (default 1) in universal configuration:

$globals['securelinks_kmod'] = 1;  // try load on onboot/install
$globals['securelinks_kmod'] = 0;  // opt out

Onboot and SimuzoFS install call the apply path so SecureLinks stays loaded after reboots and kernel-related work when enabled.

Module Parameters

Param	Default	Meaning
`enabled`	1	Master switch without unloading the module
`min_user_uid`	1000	UIDs below this are unrestricted

Kernel Updates

Kernel modules are per uname -r. After a kernel upgrade:

Run simuzo --securelinks download (or build)
Run simuzo --securelinks load or apply

Testing

simuzo --test --user=<enduser> --case='test_securelinks*'

Related Topics

SimuzoFS — Filesystem isolation
Security Hardening — Broader security practices
CLI Commands — Full CLI reference