Updated: 22 October 2026 · Applies to: CloudLinux with CageFS
CloudLinux's Link Traversal Protection can, in rare cases, break CageFS or cPanel functionality, showing an error like this:
selectorctl --set-user-current=5.4 --user=user Error: failed to create symlink /home/user/.cagefs/opt/alt/php52/link/conf to /opt/alt/php52/etc/php.d: [Err code 13] Permission denied Error: failed to create symlink /home/user/.cagefs/opt/alt/php53/link/conf to /opt/alt/php53/etc/php.d: [Err code 13] Permission denied
This means the protection is enabled (both fs.protected_symlinks_create and fs.protected_hardlinks_create set to 1), but fs.protected_symlinks_allow_gid and fs.protected_hardlinks_allow_gid are not set to the correct group ID: they need to match the linksafe group.
Check and fix the group ID
Find the linksafe group's GID:
getent group linksafe
This shows something like linksafe:x:993:mailman, meaning the GID is 993. Then check the current sysctl values:
sysctl -a | grep allow_gid
They should read, using the GID you found above (it may differ from 993 on your server):
fs.protected_hardlinks_allow_gid = 993 fs.protected_symlinks_allow_gid = 993
If either value does not match the linksafe GID, contact your hosting provider's support or CloudLinux's own support to correct it; these are server-wide kernel parameters, not something to change without confirming the correct value and the right place to set it permanently for your CloudLinux version. Since the setting affects every account on the server, a change made without checking the current value first can re-break link traversal protection for everyone else, not just fix it for the account that hit the error.
