---
title: Package "prelink" Must not be Installed
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Package "prelink" Must not be Installed
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Package "prelink" Must not be Installed
 
## Description{% #description %}

The `prelink` package can be removed with the following command:

```
 $ apt-get remove prelink
```

## Rationale{% #rationale %}

The use of the `prelink` package can interfere with the operation of AIDE since it binaries. Prelinking can also increase damage caused by vulnerability in a common library like libc.

## Remediation{% #remediation %}

### Shell script{% #shell-script %}

The following script can be run on the host to remediate the issue.

```bash
#!/bin/bash

if [[ -f /usr/sbin/prelink ]];
then
prelink -ua
fi

# check wether the package is virtual: if not, purge it.
# if the package is virtual, iterate on providers
#  if a provider is installed, purge it
is_virtual=`apt-cache showpkg "prelink" | grep -Pzc 'Versions: \n\n'`
if [ $is_virtual = 1 ]; then
    rprovides_line=`apt-cache showpkg "prelink" | grep -n 'Reverse Provides:' | cut -f1 -d:`
    pkglist=`apt-cache showpkg "prelink" | tail -n +$(($rprovides_line + 1)) | cut -f1 -d' '`
    for package in $pkglist; do
        # dpkg-query reports the config-files state of a removed provider,
        # which apt-cache policy shows as not installed.
        status=`dpkg-query -W -f='${db:Status-Status}' "$package" 2>/dev/null`
        if [ -n "$status" ] && [ "$status" != not-installed ]; then
            DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=60 purge -y "$package"
        fi
    done
else
    DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=60 purge -y "prelink"
fi
```

### Ansible playbook{% #ansible-playbook %}

The following playbook can be run with Ansible to remediate the issue.

```
- name: Check If Prelinked Is Installed
  ansible.builtin.stat:
    path: /usr/sbin/prelink
    get_checksum: false
  register: prelink
  tags:
  - disable_strategy
  - low_disruption
  - medium_complexity
  - medium_severity
  - no_reboot_needed
  - package_prelink_removed

- name: Restore Prelinked Binaries
  ansible.builtin.command:
    cmd: prelink -ua
  when: prelink.stat.exists
  tags:
  - disable_strategy
  - low_disruption
  - medium_complexity
  - medium_severity
  - no_reboot_needed
  - package_prelink_removed

- name: Ensure prelink is Removed
  ansible.builtin.apt:
    name: prelink
    state: absent
    purge: true
  tags:
  - disable_strategy
  - low_disruption
  - medium_complexity
  - medium_severity
  - no_reboot_needed
  - package_prelink_removed
```