From a000ed181cd8fe23809892c13393491dfeeba1d1 Mon Sep 17 00:00:00 2001 From: Aneesh Agrawal Date: Sat, 8 Oct 2016 10:40:12 -0400 Subject: [PATCH] linux config: enable the Yama LSM (#14392) The Yama Linux Security Module restricts the use of ptrace so that processes cannot ptrace processes that are not their children. This prevents attackers from compromising one user-level processes and snooping on the memory and runtime state of other processes owned by the same user. --- pkgs/os-specific/linux/kernel/common-config.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix index 3a13001a80d..c41e999ef78 100644 --- a/pkgs/os-specific/linux/kernel/common-config.nix +++ b/pkgs/os-specific/linux/kernel/common-config.nix @@ -284,6 +284,7 @@ with stdenv.lib; RANDOMIZE_BASE? y STRICT_DEVMEM y # Filter access to /dev/mem SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default + SECURITY_YAMA y # Prevent processes from ptracing non-children processes DEVKMEM n # Disable /dev/kmem ${if versionOlder version "3.14" then '' CC_STACKPROTECTOR? y # Detect buffer overflows on the stack