From 86721a5f78718caf10c578e9501f8b4d19c0eb44 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Tue, 21 Mar 2017 18:41:58 +0100 Subject: [PATCH] Allow attaching to non-child processes by default The inability to run strace or gdb is the kind of developer-unfriendliness that we're used to from OS X, let's not do it on NixOS. This restriction can be re-enabled by setting boot.kernel.sysctl."kernel.yama.ptrace_scope" = 1; It might be nice to have a NixOS module for enabling hardened defaults. Xref #14392. Thanks @abbradar. --- nixos/doc/manual/release-notes/rl-1703.xml | 9 --------- nixos/modules/config/sysctl.nix | 4 ++++ 2 files changed, 4 insertions(+), 9 deletions(-) diff --git a/nixos/doc/manual/release-notes/rl-1703.xml b/nixos/doc/manual/release-notes/rl-1703.xml index 3697b69fcf5..cae46258b80 100644 --- a/nixos/doc/manual/release-notes/rl-1703.xml +++ b/nixos/doc/manual/release-notes/rl-1703.xml @@ -95,15 +95,6 @@ following incompatible changes: - - - The Yama LSM is now enabled by default in the kernel, - which prevents ptracing non-child processes. - This means you will not be able to attach gdb to an existing process, - but will need to start that process from gdb (so it is a child). - - - The stripHash bash function in stdenv diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix index 61b02c5ffa6..a3f7e8f722f 100644 --- a/nixos/modules/config/sysctl.nix +++ b/nixos/modules/config/sysctl.nix @@ -64,5 +64,9 @@ in # Removed under grsecurity. boot.kernel.sysctl."kernel.kptr_restrict" = if (config.boot.kernelPackages.kernel.features.grsecurity or false) then null else 1; + + # Disable YAMA by default to allow easy debugging. + boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0; + }; }