4 ms·
Can I clarify the distinction between the two capabilities? Are you saying that if I download and execute e.g. “fake-meme-creator” which turns out to be malware
by QasimK 9y ago
Can I clarify the distinction between the two capabilities? Are you saying that if I download and execute e.g. “fake-meme-creator” which turns out to be malware for whatever reason, then it can read the filesystem as any normal process can, but it cannot access ptrace?
If this is the case, I’d consider it to be useful because in general I don’t trust apps as a rule.
- jcranmer 9y agoThe way most systems are configured, your fake-meme-creator could access ptrace and the filesystem.
- s_gourichon 9y agoWhat is "most systems"? A few years ago this was true. A decent distribution nowadays sets /proc/sys/kernel/yama/ptrace_scope to disallow any process to spy on other processes. ptrace_scope was apparently introduced in 2011-2012, see https://github.com/torvalds/linux/commits/a2e5790d841658485d642196dbb0927303d6c22f/security/yama/yama_lsm.c https://github.com/torvalds/linux/commits/a2e5790d841658485d... For more information: https://www.kernel.org/doc/Documentation/security/Yama.txt https://www.kernel.org/doc/Documentation/security/Yama.txt https://en.wikipedia.org/wiki/Ptrace https://en.wikipedia.org/wiki/Ptrace https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2d514487faf188938a4ee4fb3464eeecfbdcf8eb https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... (via https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace_Protection https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening... )
- cozzyd 9y agoYeah but anyone developing will likely turn that off as it interferes with attaching gdb/strace/etc