Date: Wed, 2 Jan 2019 11:09:47 +0100 From: Jakub Wilk <jwilk@...lk.net> To: oss-security@...ts.openwall.com Cc: Niels Möller <nisse@...ator.liu.se> Subject: Re: Disabling ptrace * Niels Möller <nisse@...ator.liu.se>, 2019-01-01, 12:27: >Matthew Fernandez <matthew.fernandez@...il.com> writes: >>E.g. you can attach to the victim process with gdb/ptrace and simply >>read its memory, if the sysadmin has not blocked this with Yama or >>similar. > >I think one can disable this in the process itself, using prctl with >PR_SET_DUMPABLE. But documentation is a bit unclear and doesn't >exlicitly mention effect on ptrace The prctl(2) man page reads: “Processes that are not dumpable can not be attached via ptrace(2) PTRACE_ATTACH; see ptrace(2) for further details.” >(and other debugging interfaces). What other interfaces do you have in mind? -- Jakub Wilk
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.