Allow attaching to non-child processes by default
The inability to run strace or gdb is the kind of developer-unfriendliness that we're used to from OS X, let's not do it on NixOS. This restriction can be re-enabled by setting boot.kernel.sysctl."kernel.yama.ptrace_scope" = 1; It might be nice to have a NixOS module for enabling hardened defaults. Xref #14392. Thanks @abbradar.
This commit is contained in:
parent
78bb734452
commit
86721a5f78
|
@ -95,15 +95,6 @@ following incompatible changes:</para>
|
||||||
</para>
|
</para>
|
||||||
</listitem>
|
</listitem>
|
||||||
|
|
||||||
<listitem>
|
|
||||||
<para>
|
|
||||||
The Yama LSM is now enabled by default in the kernel,
|
|
||||||
which prevents ptracing non-child processes.
|
|
||||||
This means you will not be able to attach gdb to an existing process,
|
|
||||||
but will need to start that process from gdb (so it is a child).
|
|
||||||
</para>
|
|
||||||
</listitem>
|
|
||||||
|
|
||||||
<listitem>
|
<listitem>
|
||||||
<para>
|
<para>
|
||||||
The <literal>stripHash</literal> bash function in <literal>stdenv</literal>
|
The <literal>stripHash</literal> bash function in <literal>stdenv</literal>
|
||||||
|
|
|
@ -64,5 +64,9 @@ in
|
||||||
# Removed under grsecurity.
|
# Removed under grsecurity.
|
||||||
boot.kernel.sysctl."kernel.kptr_restrict" =
|
boot.kernel.sysctl."kernel.kptr_restrict" =
|
||||||
if (config.boot.kernelPackages.kernel.features.grsecurity or false) then null else 1;
|
if (config.boot.kernelPackages.kernel.features.grsecurity or false) then null else 1;
|
||||||
|
|
||||||
|
# Disable YAMA by default to allow easy debugging.
|
||||||
|
boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0;
|
||||||
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue
Block a user