Re: Disabling ptrace

[Jakub Wilk <jwilk () jwilk net>]

* Niels Möller <nisse () lysator liu se>, 2019-01-01, 12:27:
> Matthew Fernandez <matthew.fernandez () gmail com> writes:
> > E.g. you can attach to the victim process with gdb/ptrace and simply 
> > read its memory, if the sysadmin has not blocked this with Yama or 
> > similar.
>
> I think one can disable this in the process itself, using prctl with 
> PR_SET_DUMPABLE. But documentation is a bit unclear and doesn't 
> exlicitly mention effect on ptrace

The prctl(2) man page reads: “Processes that are not dumpable can not be 
attached via ptrace(2) PTRACE_ATTACH; see ptrace(2) for further 
details.”

> (and other debugging interfaces).

What other interfaces do you have in mind?

--
Jakub Wilk