3 ms·
What is "most systems"? A few years ago this was true. A decent distribution nowadays sets /proc/sys/kernel/yama/ptrace_scope to disallow any process to spy on
by s_gourichon 9y ago
What is "most systems"? A few years ago this was true.
A decent distribution nowadays sets /proc/sys/kernel/yama/ptrace_scope to disallow any process to spy on other processes.
ptrace_scope was apparently introduced in 2011-2012, see https://github.com/torvalds/linux/commits/a2e5790d841658485d642196dbb0927303d6c22f/security/yama/yama_lsm.c https://github.com/torvalds/linux/commits/a2e5790d841658485d...
For more information:
https://www.kernel.org/doc/Documentation/security/Yama.txt https://www.kernel.org/doc/Documentation/security/Yama.txt
https://en.wikipedia.org/wiki/Ptrace https://en.wikipedia.org/wiki/Ptrace
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2d514487faf188938a4ee4fb3464eeecfbdcf8eb https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... (via
https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace_Protection https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening... )
- cozzyd 9y agoYeah but anyone developing will likely turn that off as it interferes with attaching gdb/strace/etc