anitazha / rpms / systemd

Forked from rpms/systemd 3 years ago
Clone
36e8a3
# The ptrace system call is used for interprocess services,
36e8a3
# communication and introspection (like synchronisation, signaling,
36e8a3
# debugging, tracing and profiling) of processes.
36e8a3
#
36e8a3
# Usage of ptrace is restricted by normal user permissions. Normal
36e8a3
# unprivileged processes cannot use ptrace on processes that they
36e8a3
# cannot send signals to or processes that are running set-uid or
36e8a3
# set-gid. Nevertheless, processes running under the same uid will
36e8a3
# usually be able to ptrace one another.
36e8a3
#
36e8a3
# Fedora enables the Yama security mechanism which restricts ptrace
36e8a3
# even further. Sysctl setting kernel.yama.ptrace_scope can have one
36e8a3
# of the following values:
36e8a3
#
36e8a3
# 0 - Normal ptrace security permissions.
36e8a3
# 1 - Restricted ptrace. Only child processes plus normal permissions.
36e8a3
# 2 - Admin-only attach. Only executables with CAP_SYS_PTRACE.
36e8a3
# 3 - No attach. No process may call ptrace at all. Irrevocable.
36e8a3
#
36e8a3
# For more information see Documentation/security/Yama.txt in the
36e8a3
# kernel sources.
36e8a3
#
36e8a3
# The default is 1., which allows tracing of child processes, but
36e8a3
# forbids tracing of arbitrary processes. This allows programs like
36e8a3
# gdb or strace to work when the most common way of having the
36e8a3
# debugger start the debuggee is used:
36e8a3
#    gdb /path/to/program ...
36e8a3
# Attaching to already running programs is NOT allowed:
36e8a3
#    gdb -p ...
36e8a3
# This default setting is suitable for the common case, because it
36e8a3
# reduces the risk that one hacked process can be used to attack other
36e8a3
# processes. (For example, a hacked firefox process in a user session
36e8a3
# will not be able to ptrace the keyring process and extract passwords
36e8a3
# stored only in memory.)
36e8a3
#
36e8a3
# Developers and administrators might want to disable those protections
36e8a3
# to be able to attach debuggers to existing processes. Use
36e8a3
#   sysctl kernel.yama.ptrace_scope=0
36e8a3
# for change the setting temporarily, or copy this file to
36e8a3
# /etc/sysctl.d/20-yama-ptrace.conf to set it for future boots.
36e8a3
36e8a3
kernel.yama.ptrace_scope = 0