Add fs link protection sysctls
@@ -18,3 +18,5 @@ net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
kernel.perf_event_paranoid = 3
+fs.protected_hardlinks = 1
+fs.protected_symlinks = 1
