feat: manage ptrace access using SELinux#2012
Draft
HastD wants to merge 2 commits intosecureblue:livefrom
Draft
Conversation
8d1bf45 to
01c3bae
Compare
Collaborator
Author
|
Results of testing in a
|
4483b16 to
c86be73
Compare
Use SELinux in combination with Yama (instead of just Yama) to manage ptrace access in a more fine-grained way. See issue secureblue#2007 for more detailed discussion of the motivation for this change. * Make `kernel.yama.ptrace_scope` default to 1 instead of 3. * Enable the SELinux boolean `deny_ptrace` by default. * Create a new SELinux boolean, `container_allow_ptrace`, that allows `container_domain` to use ptrace (irrespective of the `deny_ptrace` setting). * Replace `ujust toggle-anticheat-support` (alias `ujust toggle-ptrace-scope`) with `ujust set-ptrace` (alias `ujust set-anticheat-support`). The new ujust script is written in Python, follows the usage conventions for other `ujust set-*` scripts, and allows selecting between three modes for ptrace access: on/enabled, container-only, and off/disabled. * Make `ujust toggle-debug-mode` temporarily enable (restricted) ptrace for the session. * Add a systemd service, `secureblue-ptrace-migration.service`, that automatically migrates users to the new SELinux-based ptrace controls: values of `kernel.yama.ptrace_scope` of 1, 2, or 3 will be respectively mapped to the ptrace modes "enabled", "container-only", and "disabled" (all with ptrace_scope = 1). * Modify `ujust audit-secureblue`, `ujust install-dangerzone`, and `ujust install-steam` to take into account the new method of ptrace access management.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Use SELinux in combination with Yama (instead of just Yama) to manage ptrace access in a more fine-grained way. See issue #2007 for more detailed discussion of the motivation for this change.
kernel.yama.ptrace_scopedefault to 1 instead of 3.deny_ptraceby default.container_allow_ptrace, that allowscontainer_domainto use ptrace (irrespective of thedeny_ptracesetting).ujust toggle-anticheat-support(aliasujust toggle-ptrace-scope) withujust set-ptrace(aliasujust set-anticheat-support). The new ujust script is written in Python, follows the usage conventions for otherujust set-*scripts, and allows selecting between three modes for ptrace access: on/enabled, container-only, and off/disabled.ujust toggle-debug-modetemporarily enable (restricted) ptrace for the session.secureblue-ptrace-migration.service, that automatically migrates users to the new SELinux-based ptrace controls: values ofkernel.yama.ptrace_scopeof 1, 2, or 3 will be respectively mapped to the ptrace modes "enabled", "container-only", and "disabled" (all with ptrace_scope = 1).ujust audit-secureblue,ujust install-dangerzone, andujust install-steamto take into account the new method of ptrace access management.Resolves #2007.