[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 02 Jan 2019 11:21:27 +0100
From: nisse@...ator.liu.se (Niels Möller)
To: oss-security@...ts.openwall.com
Subject: Re: Disabling ptrace
Jakub Wilk <jwilk@...lk.net> writes:
> * Niels Möller <nisse@...ator.liu.se>, 2019-01-01, 12:27:
>>Matthew Fernandez <matthew.fernandez@...il.com> writes:
>>> E.g. you can attach to the victim process with gdb/ptrace and
>>> simply read its memory, if the sysadmin has not blocked this with
>>> Yama or similar.
>>
>> I think one can disable this in the process itself, using prctl with
>> PR_SET_DUMPABLE. But documentation is a bit unclear and doesn't
>> exlicitly mention effect on ptrace
>
> The prctl(2) man page reads: “Processes that are not dumpable can not
> be attached via ptrace(2) PTRACE_ATTACH; see ptrace(2) for further
> details.”
Thanks, I somehow missed that. So prctl should be the right tool, then.
>>(and other debugging interfaces).
>
> What other interfaces do you have in mind?
I had the impression that ptrace was old-fashined, and that current gdb
used other interfaces via /proc (with permissions also affected by
prctl). But I may be mistaken; I've never looked into those details.
Regards,
/Niels
--
Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677.
Internet email is subject to wholesale government surveillance.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
