On Sun, Aug 02, 2015 at 12:57:53AM +0000, Zbigniew Jędrzejewski-Szmek wrote:
On Sat, Aug 01, 2015 at 10:08:14PM +0200, Mark Wielaard wrote:
On Mon, Jul 06, 2015 at 03:49:18PM +0200, Mark Wielaard wrote:
On Mon, 2015-07-06 at 09:39 -0400, Josh Boyer wrote:
On Mon, Jul 6, 2015 at 9:10 AM, Mark Wielaard mjw@redhat.com wrote:
https://bugzilla.redhat.com/show_bug.cgi?id=1209492 (an to this email) to revert the yama config setting to the upstream default. This fixes
That would make the sysctl file systemd just added on your request completely pointless and actually incorrect because changing the value wouldn't work at all.
Yes, that is a downside of the patch. You won't be able to switch the default value anymore. But if we cannot do that by installing the sysctl file in either the kernel or systemd the alternative would be to hunt down and fix all individually packages that rely on ptrace working normally. Which seems unattractive to me if the fix in the kernel is so simple.
It took some time but we eventually came up with a solution. Stephen Smalley who added the support for yama originally to the fedora kernel agrees with the approach. And Paul Moore is making sure this gets merged upstream. Attached are commits for f22, f23 and master. Please let me know if you need anything else to get these applied.
So... yama consists of one thing, the ptrace scope setting. Your patch sets the ptrace scope setting back to 0. So yama would be compiled in, but disabled.
Yes, see the bug report for the (very long) discussion of why.
Cheers,
Mark