Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-11-25 22:18:33 -05:00
Code Issues Projects Releases Packages Wiki Activity

Disable the usage of ptrace() by all processes

Browse source
This commit is contained in:
raja-grewal 2025-09-28 03:20:24 +00:00 • committed by GitHub
parent 22c9863493
commit 194b8fce4e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 9 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

17
README.md
View file

@ -58,9 +58,8 @@ configuration file and significant hardening is applied to a myriad of component
#### User space #### User space
- Restrict usage of `ptrace()` to only processes with `CAP_SYS_PTRACE` as it - Disable the usage of `ptrace()` by all processes as it enables programs to inspect
enables programs to inspect and modify other active processes. Optional - Disable and modify other active processes
usage of `ptrace()` by all processes.
- Maximize the bits of entropy used for mmap ASLR across all CPU architectures. - Maximize the bits of entropy used for mmap ASLR across all CPU architectures.
@ -273,23 +272,15 @@ there are a few cases of partial or non-compliance due to technical limitations.
More than 30 kernel boot parameters and over 30 sysctl settings are fully aligned with More than 30 kernel boot parameters and over 30 sysctl settings are fully aligned with
the KSPP's recommendations. the KSPP's recommendations.
**Partial compliance:**
1. `sysctl kernel.yama.ptrace_scope=3`
Completely disables `ptrace()`. Can be enabled easily if needed.
* [security-misc pull request #242](https://github.com/Kicksecure/security-misc/pull/242)
**Non-compliance:** **Non-compliance:**
2. `sysctl user.max_user_namespaces=0` 1. `sysctl user.max_user_namespaces=0`
Disables user namespaces entirely. Not recommended due to the potential for widespread breakages. Disables user namespaces entirely. Not recommended due to the potential for widespread breakages.
* [security-misc pull request #263](https://github.com/Kicksecure/security-misc/pull/263) * [security-misc pull request #263](https://github.com/Kicksecure/security-misc/pull/263)
3. `sysctl fs.binfmt_misc.status=0` 2. `sysctl fs.binfmt_misc.status=0`
Disables the registration of interpreters for miscellaneous binary formats. Currently not Disables the registration of interpreters for miscellaneous binary formats. Currently not
feasible due to compatibility issues with Firefox. feasible due to compatibility issues with Firefox.

13
usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared
View file

@ -227,8 +227,8 @@ kernel.io_uring_disabled=2
## ##
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-userspace ## https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-userspace
## Restrict usage of the ptrace() system call to only processes with CAP_SYS_PTRACE. ## Diable the usage of the ptrace() system call by all processes.
## Limit ptrace() as it enables programs to inspect and modify other active processes. ## Restrict ptrace() as it enables programs to inspect and modify other active processes.
## Prevents native code debugging which some programs use as a method to detect tampering. ## Prevents native code debugging which some programs use as a method to detect tampering.
## May cause breakages in 'anti-cheat' software and programs running under Proton/WINE. ## May cause breakages in 'anti-cheat' software and programs running under Proton/WINE.
## ##
@ -238,13 +238,10 @@ kernel.io_uring_disabled=2
## https://github.com/GrapheneOS/os-issue-tracker/issues/651#issuecomment-917599928 ## https://github.com/GrapheneOS/os-issue-tracker/issues/651#issuecomment-917599928
## https://github.com/netblue30/firejail/issues/2860 ## https://github.com/netblue30/firejail/issues/2860
## ##
## KSPP=partial ## KSPP=yes
## KSPP sets the stricter sysctl kernel.yama.ptrace_scope=3. ## KSPP sets the sysctl.
## ##
## It is possible to harden further by disabling ptrace() for all users, see documentation. kernel.yama.ptrace_scope=3
## https://github.com/Kicksecure/security-misc/pull/242
##
kernel.yama.ptrace_scope=2
## Maximize bits of entropy for improved effectiveness of mmap ASLR. ## Maximize bits of entropy for improved effectiveness of mmap ASLR.
## The maximum number of bits depends on CPU architecture (the ones shown below are for x86). ## The maximum number of bits depends on CPU architecture (the ones shown below are for x86).