1 # When yama is enabled in the kernel it might be used to filter any user 2 # space access which requires PTRACE_MODE_ATTACH like ptrace attach, access 3 # to /proc/PID/{mem,personality,stack,syscall}, and the syscalls 4 # process_vm_readv and process_vm_writev which are used for interprocess 5 # services, communication and introspection (like synchronisation, signaling, 6 # debugging, tracing and profiling) of processes. 7 # 8 # Usage of ptrace attach is restricted by normal user permissions. Normal 9 # unprivileged processes cannot interact through ptrace with processes 10 # that they cannot send signals to or processes that are running set-uid 11 # or set-gid. 12 # 13 # yama ptrace scope can be used to reduce these permissions even more. 14 # This should normally not be done because it will break various programs 15 # relying on the default ptrace security restrictions. But can be used 16 # if you don't have any other way to separate processes in their own 17 # domains. A different way to restrict ptrace is to set the selinux 18 # deny_ptrace boolean. Both mechanisms will break some programs relying 19 # on the ptrace system call and might force users to elevate their 20 # priviliges to root to do their work. 21 # 22 # For more information see Documentation/security/Yama.txt in the kernel 23 # sources. Which also describes the defaults when CONFIG_SECURITY_YAMA 24 # is enabled in a kernel build (currently 1 for ptrace_scope). 25 # 26 # This runtime kernel parameter can be set to the following options: 27 # (Note that setting this to anything except zero will break programs!) 28 # 29 # 0 - Default attach security permissions. 30 # 1 - Restricted attach. Only child processes plus normal permissions. 31 # 2 - Admin-only attach. Only executables with CAP_SYS_PTRACE. 32 # 3 - No attach. No process may call ptrace at all. Irrevocable. 33 # 34 kernel.yama.ptrace_scope = 0 35 36
