Re:Unprivileged Process Injection Techniques in Linux
by deadlydose on Sunday December 31, 2023 @11:07AM
(#38824989)
I think this is so users can choose what level of restriction they want using kernel.yama.ptrace_scope with sysctl, 0 being the default and 2 being the most restrictive.
Re:Unprivileged Process Injection Techniques in Linux
by Retr0id on Sunday December 31, 2023 @11:52AM
(#38825385)
You can configure it on most distros, it doesn't excuse having an insecure default.
Re:Unprivileged Process Injection Techniques in Linux
by secure on Sunday December 31, 2023 @12:50PM
(#38825935)
The Debian patch for this setting is: https://salsa.debian.org/kernel-team/linux/-/blob/master/deb...
The decision made there is from 2013 (see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=712740), so it might be worth revisiting.
Could you file a bug report to get the discussion started?
It absolutely blew my mind to learn that Debian is still shipping with Yama mitigations disabled by default (last time I checked, which was about a year ago). I think they're one of the only mainstream distros to be doing this, although I haven't done a comprehensive survey.