---
title: "HOST-BOOT-007 Prelink Installed"
canonical: https://openvapt.com/checks/HOST-BOOT-007.html
html: https://openvapt.com/checks/HOST-BOOT-007.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-BOOT-007 Prelink Installed

Checks that the prelink tool is absent, or disabled where the package is still installed.

- Domain: Server
- Severity: Low
- Control category: Secure Configuration
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N`
- CIS Controls v8: 4.8
- NIST CSF 2.0: PR.PS-01, PR.IR-01
- CWE: CWE-344
- NIST SP 800-53 Rev. 5: SI-7, CM-7
- Benchmark topic: Prelink not installed (CIS Controls v8 4.8) (topic only, no benchmark text)

## Why It Matters

Prelink rewrites binaries and libraries in place, which changes their hashes and defeats integrity monitoring and package verification, and it weakens address randomisation by fixing load addresses. Modern systems gain nothing from it.

## How It Detects

Stats /usr/sbin/prelink, /usr/bin/prelink and /etc/prelink.conf. If any exists, reads /etc/sysconfig/prelink and /etc/default/prelink for  PRELINKING=no, which passes with a note. Absent files pass; a stat error other than not-found is incomplete.

## How to Fix

Undo and remove it:  prelink -ua && apt purge prelink  (or  dnf remove prelink). Then re-initialise the integrity database (aide --init).

## How to Verify

```
command -v prelink  should print nothing.
```

## Learn the Theory

- [P17 Kernel, Filesystem and Boot Hardening](https://openvapt.com/academy/p17.md)

## References

- [prelink(8), Linux man-pages](https://man7.org/linux/man-pages/man8/prelink.8.html)
- [NIST SP 800-53 Rev. 5, Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/boot.go

Run it: `openvapt scan --only HOST-BOOT-007`. Read it offline: `openvapt explain HOST-BOOT-007`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-BOOT-007.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.