Disabling ptrace (was Re: [oss-security] Asserts considered harmful (or GMP spills its sensitive information))

[nisse () lysator liu se (Niels Möller)]

Matthew Fernandez <matthew.fernandez () gmail com> writes:

> E.g. you can attach
> to the victim process with gdb/ptrace and simply read its memory, if
> the sysadmin has not blocked this with Yama or similar.

I think one can disable this in the process itself, using prctl with
PR_SET_DUMPABLE. But documentation is a bit unclear and doesn't
exlicitly mention effect on ptrace (and other debugging interfaces).

If there are any documented best practices, that would be very nice.

My main usecase is lshd (an ssh daemon), which spawns a helper process
with uid of the logged in user, but with gid set to the utmp group, to
provide restricted write access to the utmp database. This is spawned by
a process running as root, so no setuid or setgid executables involved.

Attaching to that process with gdb may imply privilege escalation to
compromise utmp. Last time I tried to investigate, including reading
some linux kernel sources, PR_SET_DUMPABLE looked promising.

(Note I'm not subscribed to the oss-security list, and I'm dropping the
gmp-bugs list where this is off-topic. So please include my email in any
replies).

Regards,
/Niels

-- 
Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677.
Internet email is subject to wholesale government surveillance.