[PATCH] Add 10-yama-ptrace.conf (rhbz 1209492)

[Paul Moore]

On Monday, August 03, 2015 06:30:13 PM Josh Boyer wrote:
> On Mon, Aug 3, 2015 at 5:49 PM, Paul Moore <pmoore at redhat.com> wrote:
> > On Saturday, August 01, 2015 10:08:14 PM Mark Wielaard wrote:
> >> On Mon, Jul 06, 2015 at 03:49:18PM +0200, Mark Wielaard wrote:
> >> > On Mon, 2015-07-06 at 09:39 -0400, Josh Boyer wrote:
> >> > > On Mon, Jul 6, 2015 at 9:10 AM, Mark Wielaard <mjw at redhat.com> wrote:
> >> > > > https://bugzilla.redhat.com/show_bug.cgi?id=1209492 (an to this
> >> > > > email)
> >> > > > to revert the yama config setting to the upstream default. This
> >> > > > fixes
> >> > > 
> >> > > That would make the sysctl file systemd just added on your request
> >> > > completely pointless and actually incorrect because changing the
> >> > > value
> >> > > wouldn't work at all.
> >> > 
> >> > Yes, that is a downside of the patch. You won't be able to switch the
> >> > default value anymore. But if we cannot do that by installing the
> >> > sysctl
> >> > file in either the kernel or systemd the alternative would be to hunt
> >> > down and fix all individually packages that rely on ptrace working
> >> > normally. Which seems unattractive to me if the fix in the kernel is so
> >> > simple.
> >> 
> >> It took some time but we eventually came up with a solution.  Stephen
> >> Smalley who added the support for yama originally to the fedora kernel
> >> agrees with the approach. And Paul Moore is making sure this gets merged
> >> upstream. Attached are commits for f22, f23 and master. Please let me
> >> know
> >> if you need anything else to get these applied.
> > 
> > For the record, I don't really consider this a long term solution as the
> > risks associated with ptrace() still exist.  While Mark and a few others
> > on the BZ are happy to discount the risk, I am not.  However, my current
> > workload doesn't allow me to keep arguing with Mark so I'm looking into
> > ways to leave Yama in the kernel, but disabled by default.  If someone
> > else is able to continue fighting for ptrace restrictions at this point
> > in time, I would suggest adding yourself to the BZ.
> > 
> > Also, it appears that the patch I posted last week isn't really viable
> > upstream due to a general distaste of setting sysctl defaults with CONFIG
> > settings.  I have another thought, but I think that discussion is better
> > had on the BZ than on this list.
> 
> Right.  This is what I meant by "carrying a patch forever" in the bug.
> And because of that, I'm probably not going to apply this to Fedora.

I was only proposing the patch upstream; if it isn't upstream I don't want us 
to carry it either.

> If you have a link to the upstream conversation I would appreciate it.

Unfortunately, the LSM lists appears to be having some issues at the moment, 
one of which is that the MARC archives do not appear current.

-- 
paul moore
security @ redhat