Guarding /tmp: How fs.protected_symlinks and fs.protected_regular Harden Your Kernel
Enable fs.protected_symlinks and fs.protected_regular to block symlink and hardlink races in /tmp. Learn how to verify, enable, test, and what side‑effects to watch for.