Allow attaching to non-child processes by default
The inability to run strace or gdb is the kind of developer-unfriendliness that we're used to from OS X, let's not do it on NixOS. This restriction can be re-enabled by setting boot.kernel.sysctl."kernel.yama.ptrace_scope" = 1; It might be nice to have a NixOS module for enabling hardened defaults. Xref #14392. Thanks @abbradar.
This commit is contained in:
parent
78bb734452
commit
86721a5f78
|
@ -95,15 +95,6 @@ following incompatible changes:</para>
|
|||
</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>
|
||||
The Yama LSM is now enabled by default in the kernel,
|
||||
which prevents ptracing non-child processes.
|
||||
This means you will not be able to attach gdb to an existing process,
|
||||
but will need to start that process from gdb (so it is a child).
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>
|
||||
The <literal>stripHash</literal> bash function in <literal>stdenv</literal>
|
||||
|
|
|
@ -64,5 +64,9 @@ in
|
|||
# Removed under grsecurity.
|
||||
boot.kernel.sysctl."kernel.kptr_restrict" =
|
||||
if (config.boot.kernelPackages.kernel.features.grsecurity or false) then null else 1;
|
||||
|
||||
# Disable YAMA by default to allow easy debugging.
|
||||
boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0;
|
||||
|
||||
};
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue