On Sat, Aug 01, 2015 at 10:08:14PM +0200, Mark Wielaard wrote:
> On Mon, Jul 06, 2015 at 03:49:18PM +0200, Mark Wielaard wrote:
> > On Mon, 2015-07-06 at 09:39 -0400, Josh Boyer wrote:
> > > On Mon, Jul 6, 2015 at 9:10 AM, Mark Wielaard <mjw(a)redhat.com>
wrote:
> > > >
https://bugzilla.redhat.com/show_bug.cgi?id=1209492 (an to this
email)
> > > > to revert the yama config setting to the upstream default. This
fixes
> > >
> > > That would make the sysctl file systemd just added on your request
> > > completely pointless and actually incorrect because changing the value
> > > wouldn't work at all.
> >
> > Yes, that is a downside of the patch. You won't be able to switch the
> > default value anymore. But if we cannot do that by installing the sysctl
> > file in either the kernel or systemd the alternative would be to hunt
> > down and fix all individually packages that rely on ptrace working
> > normally. Which seems unattractive to me if the fix in the kernel is so
> > simple.
>
> It took some time but we eventually came up with a solution. Stephen
> Smalley who added the support for yama originally to the fedora kernel
> agrees with the approach. And Paul Moore is making sure this gets merged
> upstream. Attached are commits for f22, f23 and master. Please let me know
> if you need anything else to get these applied.
So... yama consists of one thing, the ptrace scope setting.
Your patch sets the ptrace scope setting back to 0. So yama
would be compiled in, but disabled.
Yes, see the bug report for the (very long) discussion of why.
Cheers,
Mark