Skip to main content

"cldiag --check-symlinkowngid" Fails With " Web-server user 'nobody' is not in protected group specified in /proc/sys/fs/symlinkown_gid"

Ehsan Dowlatshah
  • Updated

Symptoms

On CloudLinux servers you might run into the following error message: 

 

cldiag --check-symlinkowngid
Check fs.symlinkown_gid:
    FAILED: Web-server user 'nobody' is not in protected group specified in /proc/sys/fs/symlinkown_gid. Fix the issue to provide symlink protection for apache user and as a result make your Web Server more secure.
See details: https://docs.cloudlinux.com/command-line_tools/#check-symlinkowngid

There are 1 errors found.

 

Description 

 

This is caused when the GID of the "nobody" user does not match what's in the "/proc/sys/fs/symlinkown_gid" file: 

 

grep -Ei "\b99\b" /etc/group

cat /proc/sys/fs/symlinkown_gid
99

grep -Ei "\bnobody\b" /etc/group
nobody:x:65534:

 

Workaround

You need to manually update that value using the below steps: 

1. Run the following command to see the correct GID for the "nobody" user:

id nobody

 
2. Edit the /etc/sysctl.conf file, add or edit the line: (Replace "XX" with the GID of nobody)
 

fs.symlinkown_gid = XX

 
3. And execute:
 

$ sysctl -p

 

Related articles