hardlinks to setuid binaries

[Jan Schaumann <jschauma%netmeister.org@localhost>]

Hello,

I just came across this blog post here:
https://rachelbythebay.com/w/2022/03/15/link/

In a nutshell, the author describes how being able to
create a hardlink to a setuid binary can lead to
undesirable results:

Suppose you have a setuid /usr/pkg/bin/sudo from sudo
version 1.8.11, which is vulnerable to CVE-2014-9680.
You create a hardlink in your home directory, so you
get setuid, owned by root, mode 511 '~/sudo'.

Now the sysadmin updates the sudo package, fixing the
vulnerability, but your ~/.sudo remains vulnerable.

On Linux, there appears to be a proc(5) restriction
via /proc/sys/fs/protected_hardlinks making this
impossible, but on NetBSD at least up to 9.2 this is
possible.

Any thoughts on this?  Should there be a sysctl to
disable this?  This is not a new discovery; has this
been discussed before?

-Jan