Limit one program inspecting another

Why it matters

ptrace is the call debuggers use to read and change another running program. Without limits, malware running as you can attach to your browser, SSH agent or password manager and pull secrets out of their memory. The kernel documentation uses exactly this scenario to explain why Yama exists.

How it works

Sets kernel.yama.ptrace_scope to 1 (restricted ptrace). A process can then attach only to its own descendants, or to a process that has named it as an allowed debugger. Mode 2 allows only administrators and mode 3 forbids it entirely.

Who should use it

A sound default for desktops and servers. Developers who attach debuggers to running programs can still use sudo, or start the program under the debugger.

What you may notice

gdb -p or strace -p on an already running program fails with ptrace: Operation not permitted. Starting the program from gdb or strace still works, as does using sudo.

Check it on your computer

Read the current value:

sysctl kernel.yama.ptrace_scope

A stricter value than this one is also fine.

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w kernel.yama.ptrace_scope=1

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-kernel-ptrace.conf <<'EOF'
kernel.yama.ptrace_scope = 1
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Restrict performance events
• No memory dumps of privileged programs

Sources

Linux Hardening Guide (madaidans)

2.2.3

Linux kernel documentation, Yama

ptrace_scope