mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2024-12-23 01:23:36 +07:00
Code Issues Packages Projects Releases Wiki Activity

Disable the usage of ptrace() by all processes

Browse Source
This commit is contained in:
Raja Grewal 2024-07-18 11:01:41 +10:00
parent d454f36c63
commit b04828f858
No known key found for this signature in database
GPG Key ID: 92CA473C156B64C4
2 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
README.md
View File

@ -45,9 +45,8 @@ space, user space, core dumps, and swap space.
- Disable asynchronous I/O (when using Linux kernel version >= 6.6).
- Restrict usage of `ptrace()` to only processes with `CAP_SYS_PTRACE` as it
enables programs to inspect and modify other active processes. Provide the
option to entirely disable the use of `ptrace()` for all processes.
- Disable the usage of `ptrace()` by all processes as it enables programs to
inspect and modify other active processes.
- Prevent hardlink and symlink TOCTOU races in world-writable directories.

6
usr/lib/sysctl.d/990-security-misc.conf
View File

@ -128,7 +128,7 @@ kernel.io_uring_disabled=2
##
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-userspace
## Restrict usage of the ptrace() system call to only processes with CAP_SYS_PTRACE.
## Disable the usage of ptrace() system calls by all processes.
## Limit ptrace() as it enables programs to inspect and modify other active processes.
## Prevents native code debugging which some programs use as a method to detect tampering.
## May cause breakages in 'anti-cheat' software and programs running under Proton/WINE.
@ -139,9 +139,7 @@ kernel.io_uring_disabled=2
## https://github.com/GrapheneOS/os-issue-tracker/issues/651#issuecomment-917599928
## https://github.com/netblue30/firejail/issues/2860
##
## It is possible to harden further by disabling ptrace() for all users, see documentation.
##
kernel.yama.ptrace_scope=2
kernel.yama.ptrace_scope=3
## Maximize bits of entropy for improved effectiveness of mmap ASLR.
## The maximum number of bits depends on CPU architecture (the ones shown below are for x86).