External/sysctl
1
0
Fork 0
mirror of https://github.com/k4yt3x/sysctl.git synced 2025-12-17 17:56:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: added more descriptions for kernel.yama.ptrace_scope

Browse Source 
Signed-off-by: k4yt3x <i@k4yt3x.com>
This commit is contained in:
k4yt3x 2024-05-02 00:00:00 +00:00
parent 0283efcc03
commit 11a7d7123b
No known key found for this signature in database
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
sysctl.conf
View File

@ -4,11 +4,11 @@
# Contributor: HorlogeSkynet # Contributor: HorlogeSkynet
# Contributor: shenzhui007 # Contributor: shenzhui007
# Date Created: October 5, 2020 # Date Created: October 5, 2020
# Last Updated: July 6, 2023 # Last Updated: May 2, 2024
# Licensed under the GNU General Public License Version 3 (GNU GPL v3), # Licensed under the GNU General Public License Version 3 (GNU GPL v3),
# available at: https://www.gnu.org/licenses/gpl-3.0.txt # available at: https://www.gnu.org/licenses/gpl-3.0.txt
# (C) 2020-2023 K4YT3X # (C) 2020-2024 K4YT3X
# Multiple sources have been consulted while writing this configuration # Multiple sources have been consulted while writing this configuration
# file (e.g., nixCraft's sysctl.conf). Sources are not cited since this # file (e.g., nixCraft's sysctl.conf). Sources are not cited since this
@ -39,11 +39,15 @@ kernel.core_uses_pid = 1
kernel.kptr_restrict = 2 kernel.kptr_restrict = 2
# Ptrace protection using Yama # Ptrace protection using Yama
# - 1: only a parent process can be debugged # - 0 (classic): allows any process to trace any other process under the same UID
# - 2: only admins can use ptrace (CAP_SYS_PTRACE capability required) # - 1 (restricted): only a parent process can be debugged
# - 3: disables ptrace completely, reboot is required to re-enable ptrace # - 2 (admin-only): only admins can use ptrace (CAP_SYS_PTRACE capability required)
# be aware disabling ptrace completely breaks lxc v6+ procfs emulation for unprivileged containers # - 3 (no attach): disables ptrace completely, reboot is required to re-enable ptrace
# (see https://github.com/lxc/lxcfs/issues/636) # the general recommendation for this setting is:
# - if you do not need to debug programs, set it to 3
# - if you need to debug programs (e.g., GDB, LLDB, strace), set it to 1
# setting it to 3 will also break LXC v6+ procfs emulation for unprivileged containers
# (see GitHub issue https://github.com/lxc/lxcfs/issues/636)
kernel.yama.ptrace_scope = 3 kernel.yama.ptrace_scope = 3
# restrict kernel logs to root only # restrict kernel logs to root only