xref: /aosp_15_r20/external/elfutils/config/10-default-yama-scope.conf (revision 7304104da70ce23c86437a01be71edd1a2d7f37e)
1*7304104dSAndroid Build Coastguard Worker# When yama is enabled in the kernel it might be used to filter any user
2*7304104dSAndroid Build Coastguard Worker# space access which requires PTRACE_MODE_ATTACH like ptrace attach, access
3*7304104dSAndroid Build Coastguard Worker# to /proc/PID/{mem,personality,stack,syscall}, and the syscalls
4*7304104dSAndroid Build Coastguard Worker# process_vm_readv and process_vm_writev which are used for interprocess
5*7304104dSAndroid Build Coastguard Worker# services, communication and introspection (like synchronisation, signaling,
6*7304104dSAndroid Build Coastguard Worker# debugging, tracing and profiling) of processes.
7*7304104dSAndroid Build Coastguard Worker#
8*7304104dSAndroid Build Coastguard Worker# Usage of ptrace attach is restricted by normal user permissions. Normal
9*7304104dSAndroid Build Coastguard Worker# unprivileged processes cannot interact through ptrace with processes
10*7304104dSAndroid Build Coastguard Worker# that they cannot send signals to or processes that are running set-uid
11*7304104dSAndroid Build Coastguard Worker# or set-gid.
12*7304104dSAndroid Build Coastguard Worker#
13*7304104dSAndroid Build Coastguard Worker# yama ptrace scope can be used to reduce these permissions even more.
14*7304104dSAndroid Build Coastguard Worker# This should normally not be done because it will break various programs
15*7304104dSAndroid Build Coastguard Worker# relying on the default ptrace security restrictions. But can be used
16*7304104dSAndroid Build Coastguard Worker# if you don't have any other way to separate processes in their own
17*7304104dSAndroid Build Coastguard Worker# domains. A different way to restrict ptrace is to set the selinux
18*7304104dSAndroid Build Coastguard Worker# deny_ptrace boolean. Both mechanisms will break some programs relying
19*7304104dSAndroid Build Coastguard Worker# on the ptrace system call and might force users to elevate their
20*7304104dSAndroid Build Coastguard Worker# privileges to root to do their work.
21*7304104dSAndroid Build Coastguard Worker#
22*7304104dSAndroid Build Coastguard Worker# For more information see Documentation/security/Yama.txt in the kernel
23*7304104dSAndroid Build Coastguard Worker# sources. Which also describes the defaults when CONFIG_SECURITY_YAMA
24*7304104dSAndroid Build Coastguard Worker# is enabled in a kernel build (currently 1 for ptrace_scope).
25*7304104dSAndroid Build Coastguard Worker#
26*7304104dSAndroid Build Coastguard Worker# This runtime kernel parameter can be set to the following options:
27*7304104dSAndroid Build Coastguard Worker# (Note that setting this to anything except zero will break programs!)
28*7304104dSAndroid Build Coastguard Worker#
29*7304104dSAndroid Build Coastguard Worker# 0 - Default attach security permissions.
30*7304104dSAndroid Build Coastguard Worker# 1 - Restricted attach. Only child processes plus normal permissions.
31*7304104dSAndroid Build Coastguard Worker# 2 - Admin-only attach. Only executables with CAP_SYS_PTRACE.
32*7304104dSAndroid Build Coastguard Worker# 3 - No attach. No process may call ptrace at all. Irrevocable.
33*7304104dSAndroid Build Coastguard Worker#
34*7304104dSAndroid Build Coastguard Workerkernel.yama.ptrace_scope = 0
35*7304104dSAndroid Build Coastguard Worker
36