Package: ltrace Version: 0.7.3-5 Severity: minor User: [email protected] Usertags: selinux
Hi, ltrace is checking if the deny_ptrace SELinux boolean is enable and print a warning if it's the case. It's important to note that this boolean is RHEL/Fedora specific, distributions (like Debian/Ubuntu, gentoo,...) that are using the refpolicy doesn't have it. They have a "allow_ptrace" boolean instead (the logic is reversed). I guess that this should be tested too? But note that these booleans are only present in implementation of the SELinux policy and not part of SELinux itself. That means that one could write a policy where these booleans are not existing at all, it might even be a better idea to always print the warning if ptrace is failing with errno==EPERM and if selinux is enabled. The message could still mention the these usual booleans (deny_ptrace and allow_ptrace) as they are used on a lot of machines. Cheers, Laurent Bigonville -- System Information: Debian Release: stretch/sid APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.2.0-1-amd64 (SMP w/8 CPU cores) Locale: LANG=fr_BE.utf8, LC_CTYPE=fr_BE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages ltrace depends on: ii libc6 2.19-22 ii libelf1 0.163-5.1 ii libselinux1 2.4-2 ltrace recommends no packages. ltrace suggests no packages. -- no debconf information
