diff --git a/sysctl.conf b/sysctl.conf index fde6b53..27a8716 100644 --- a/sysctl.conf +++ b/sysctl.conf @@ -42,6 +42,8 @@ kernel.kptr_restrict = 2 # - 1: only a parent process can be debugged # - 2: only admins can use ptrace (CAP_SYS_PTRACE capability required) # - 3: disables ptrace completely, reboot is required to re-enable ptrace +# be aware disabling ptrace completely breaks lxc v6+ procfs emulation for unprivileged containers +# (see https://github.com/lxc/lxcfs/issues/636) kernel.yama.ptrace_scope = 3 # restrict kernel logs to root only