Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 2 Jan 2019 11:09:47 +0100
From: Jakub Wilk <jwilk@...lk.net>
To: oss-security@...ts.openwall.com
Cc: Niels Möller <nisse@...ator.liu.se>
Subject: Re: Disabling ptrace

* Niels Möller <nisse@...ator.liu.se>, 2019-01-01, 12:27:
>Matthew Fernandez <matthew.fernandez@...il.com> writes:
>>E.g. you can attach to the victim process with gdb/ptrace and simply 
>>read its memory, if the sysadmin has not blocked this with Yama or 
>>similar.
>
>I think one can disable this in the process itself, using prctl with 
>PR_SET_DUMPABLE. But documentation is a bit unclear and doesn't 
>exlicitly mention effect on ptrace

The prctl(2) man page reads: “Processes that are not dumpable can not be 
attached via ptrace(2) PTRACE_ATTACH; see ptrace(2) for further 
details.”

>(and other debugging interfaces).

What other interfaces do you have in mind?

-- 
Jakub Wilk

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.