# Ensure prelink is not installed

Necessity: The 'prelink' utility modifies shared libraries and binaries to speed up their load time. However, this functionality conflicts with modern security mechanisms like Address Space Layout Randomization (ASLR). By pre-calculating library load addresses, prelink effectively negates the protections offered by ASLR, making the system more vulnerable to buffer overflow and return-oriented programming (ROP) attacks. Major Linux distributions have deprecated its use due to these security concerns.

Auditing and Remediation: The audit script queries the system's package manager database (dpkg) to determine the installation status of the 'prelink' package. The remediation script uses the 'apt-get' command to completely purge the 'prelink' package and any associated configuration files from the system, thereby eliminating the security risk.

Recommended State Rationale: The only secure state is to have 'prelink' uninstalled. Its performance benefits are negligible on modern hardware and are vastly outweighed by the significant security vulnerabilities it introduces. Therefore, for all levels of hardening—Basic, Moderate, and Strict—it is recommended that the package be completely removed. This aligns with security best practices and benchmarks such as those from the Center for Internet Security (CIS).

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'prelink' package is installed. The script should use the command `dpkg-query -W -f='${Status}' prelink 2>/dev/null`. If the output contains 'ok installed', the script must return the string 'Installed'. Otherwise, it must return 'Not Installed'. The script must not output any other text.

## Remediation Script Working

Bash script that accepts a single positional command-line argument representing the desired state. If the argument is 'Not Installed', the script must execute `apt-get purge -y prelink` to remove the package. The script must output `true` on successful removal or if the package was already not present, and `false` if the removal fails.

