Re: F44 Change Proposal: Mitigate vulnerabilities/attacks by enabling kernel.kptr_restrict and net.core.bpf_jit_harden by default, and by obsoleting a package that risks to accidentally disable kernel.yama.ptrace_scope by default [SystemWide]

[Carlos Rodriguez-Fernandez]

I would add to that that people using ptrace are very likely to be familiar with this flag at this point, especially if most distros have the yama flag set to 1.

On 9/15/25 6:38 AM, Christopher Klooz wrote:

On 15/09/2025 15.11, Ian Pilcher wrote:

On 9/13/25 11:02 AM, Mark Wielaard wrote:

I believe a lot of people run tools like strace, pstack or eu-stack to
quickly see where and how their own (already running) processes are
stuck. At least I do.

Amen.

I will add that getting along-running process to finally hit that race
condition and *then* discovering that you have to reboot and reproduce
it in order to debug the problem would be a terrible UX.

Even if the proposal would be implemented with ptrace_scope being 2, you would **not** need to reboot to change the ptrace_scope condition -> `sysctl kernel.yama.ptrace_scope=0` would temporarily disable it (immediately!) without reboot.

This and other possibilities to disable ptrace_scope (during runtime or permanently) are elaborated in the section "How To Test" of the proposal, and would become part of the proposed Docs (see the Docs topic linked in the proposal about that).

OpenPGP_signature.asc
Description: OpenPGP digital signature

-- 
_______________________________________________
devel mailing list -- devel@lists.fedoraproject.org
To unsubscribe send an email to devel-le...@lists.fedoraproject.org
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org
Do not reply to spam, report it: 
https://pagure.io/fedora-infrastructure/new_issue