[PATCH] Add 10-yama-ptrace.conf (rhbz 1209492)

[Mark Wielaard]

On Sun, Aug 02, 2015 at 12:57:53AM +0000, Zbigniew Jędrzejewski-Szmek wrote:
> On Sat, Aug 01, 2015 at 10:08:14PM +0200, Mark Wielaard wrote:
> > On Mon, Jul 06, 2015 at 03:49:18PM +0200, Mark Wielaard wrote:
> > > On Mon, 2015-07-06 at 09:39 -0400, Josh Boyer wrote:
> > > > On Mon, Jul 6, 2015 at 9:10 AM, Mark Wielaard <mjw at redhat.com> wrote:
> > > > > https://bugzilla.redhat.com/show_bug.cgi?id=1209492 (an to this email)
> > > > > to revert the yama config setting to the upstream default. This fixes
> > > > 
> > > > That would make the sysctl file systemd just added on your request
> > > > completely pointless and actually incorrect because changing the value
> > > > wouldn't work at all.
> > > 
> > > Yes, that is a downside of the patch. You won't be able to switch the
> > > default value anymore. But if we cannot do that by installing the sysctl
> > > file in either the kernel or systemd the alternative would be to hunt
> > > down and fix all individually packages that rely on ptrace working
> > > normally. Which seems unattractive to me if the fix in the kernel is so
> > > simple.
> > 
> > It took some time but we eventually came up with a solution.  Stephen
> > Smalley who added the support for yama originally to the fedora kernel
> > agrees with the approach. And Paul Moore is making sure this gets merged
> > upstream. Attached are commits for f22, f23 and master. Please let me know
> > if you need anything else to get these applied.
> So... yama consists of one thing, the ptrace scope setting.
> Your patch sets the ptrace scope setting back to 0. So yama
> would be compiled in, but disabled.

Yes, see the bug report for the (very long) discussion of why.

Cheers,

Mark