3 ms·
The big exception to this is inside containers where it is often disabled by default.
by tempay 7y ago
The big exception to this is inside containers where it is often disabled by default.
- comex 7y agoOr if you have an LSM such as Yama or SELinux set to deny ptrace globally.
- justincormack 7y agoYama lets you ptrace a child process but not others.
- jwilk 7y agoBy default, yes. You can also disable ptrace() completely. (Grep for "ptrace_scope" in the ptrace(2) man page for details.)
- geofft 7y agoAIUI Docker containers by default deny the ptrace syscall (and presumably process_vm_readv/writev), they don't change the permission check. So /proc/$pid/mem, which uses the same permission check, ought to work. (This also means that you don't want or need CAP_SYS_PTRACE to get gdb/strace working in Docker, that lets you ptrace anything and also coincidentally turns off the syscall filter. Just turn the filter off, that works without privileging the processes in the container.)