Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2025-01-20 23:41:34 -05:00
Code Issues Packages Projects Releases Wiki Activity

Disable the usage of ptrace() by all processes

Browse Source
This commit is contained in:
Raja Grewal 2024-07-18 11:01:41 +10:00
parent d454f36c63
commit b04828f858
No known key found for this signature in database
GPG Key ID: 92CA473C156B64C4
2 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
README.md
View File

@ -45,9 +45,8 @@ space, user space, core dumps, and swap space.
- Disable asynchronous I/O (when using Linux kernel version >= 6.6). - Disable asynchronous I/O (when using Linux kernel version >= 6.6).
- Restrict usage of `ptrace()` to only processes with `CAP_SYS_PTRACE` as it - Disable the usage of `ptrace()` by all processes as it enables programs to
enables programs to inspect and modify other active processes. Provide the inspect and modify other active processes.
option to entirely disable the use of `ptrace()` for all processes.
- Prevent hardlink and symlink TOCTOU races in world-writable directories. - Prevent hardlink and symlink TOCTOU races in world-writable directories.

6
usr/lib/sysctl.d/990-security-misc.conf
View File

@ -128,7 +128,7 @@ kernel.io_uring_disabled=2
## ##
## https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-userspace ## https://madaidans-insecurities.github.io/guides/linux-hardening.html#sysctl-userspace
## Restrict usage of the ptrace() system call to only processes with CAP_SYS_PTRACE. ## Disable the usage of ptrace() system calls by all processes.
## Limit ptrace() as it enables programs to inspect and modify other active processes. ## Limit ptrace() as it enables programs to inspect and modify other active processes.
## Prevents native code debugging which some programs use as a method to detect tampering. ## Prevents native code debugging which some programs use as a method to detect tampering.
## May cause breakages in 'anti-cheat' software and programs running under Proton/WINE. ## May cause breakages in 'anti-cheat' software and programs running under Proton/WINE.
@ -139,9 +139,7 @@ kernel.io_uring_disabled=2
## https://github.com/GrapheneOS/os-issue-tracker/issues/651#issuecomment-917599928 ## https://github.com/GrapheneOS/os-issue-tracker/issues/651#issuecomment-917599928
## https://github.com/netblue30/firejail/issues/2860 ## https://github.com/netblue30/firejail/issues/2860
## ##
## It is possible to harden further by disabling ptrace() for all users, see documentation. kernel.yama.ptrace_scope=3
##
kernel.yama.ptrace_scope=2
## Maximize bits of entropy for improved effectiveness of mmap ASLR. ## Maximize bits of entropy for improved effectiveness of mmap ASLR.
## The maximum number of bits depends on CPU architecture (the ones shown below are for x86). ## The maximum number of bits depends on CPU architecture (the ones shown below are for x86).