sysctl: Protect hard/symlinks by default.