Re: Disabling ptrace

[nisse () lysator liu se (Niels Möller)]

Jakub Wilk <jwilk () jwilk net> writes:

> * Niels Möller <nisse () lysator liu se>, 2019-01-01, 12:27:
> > Matthew Fernandez <matthew.fernandez () gmail com> writes:
> > > E.g. you can attach to the victim process with gdb/ptrace and
> > > simply read its memory, if the sysadmin has not blocked this with
> > > Yama or similar.
> >
> > I think one can disable this in the process itself, using prctl with
> > PR_SET_DUMPABLE. But documentation is a bit unclear and doesn't
> > exlicitly mention effect on ptrace
>
> The prctl(2) man page reads: “Processes that are not dumpable can not
> be attached via ptrace(2) PTRACE_ATTACH; see ptrace(2) for further
> details.”

Thanks, I somehow missed that. So prctl should be the right tool, then.

> > (and other debugging interfaces).
>
> What other interfaces do you have in mind?

I had the impression that ptrace was old-fashined, and that current gdb
used other interfaces via /proc (with permissions also affected by
prctl). But I may be mistaken; I've never looked into those details.

Regards,
/Niels

-- 
Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677.
Internet email is subject to wholesale government surveillance.