0

I wanted to use ptrace on a recent version of Ubuntu to inspect the memory of any other process running under the same OS user. However, I quickly stumbled upon

Operation not permitted

After a quick web search I found that:

In Ubuntu 10.10 and later, users cannot ptrace processes that are not a descendant of the debugger. The behavior is controllable through the /proc/sys/kernel/yama/ptrace_scope sysctl, available via Yama.

I know that I can set this value to 0 and then do what I want. However, I was wondering if there exist any Linux distros which have ptrace_scope set to zero by default?

2

Yes, there are. For example Debian briefly made ptrace_scope=1 the default then switched back.

The protection afforded by disabling ptrace to non-child processes is somewhat limited: it prevents a real but narrow range of exploits, and at a small but non-negigible cost. An attacker who is in a position to run ptrace from a process running as some user can already run arbitrary processes as that user and access all of that user's files. Thus the ptrace_scope restrictions only protects privileges and confidential information of already-running processes, a typical case being a running key agent process (ssh-agent, gpg-agent, gnome-keyring-daemon, …) which has secrets entered by the user in its memory. The cost of the restriction is that applications can't use ptrace except to control a process that they started; this allows use cases like running a process under gdb or fakeroot but not use cases like attaching a debugger to a running program or reptyr.

1
  • Good to know that Debian yanked it back out. A process can call prctl and make itself not traceable with ptrace anyway, if it thinks it is going to hold data someone might be after. – RobotHumans Jul 22 '14 at 23:48
-1

If there are, there shouldn't be. Most of them switched shortly after: https://www.youtube.com/watch?v=hAj2_-KWeoo

Short: A smart fellow decided to implement create-remote-thread on linux via ptrace to inject code in to foreign processes.

2
  • Thanks for the answer hbdgaf. Jugaad is precisely what I tried :) However, I didn't find any source on the Internet which states that most distros switched ptrace_scope to 1 by default. Although, I agree that they should. – Benny Jul 22 '14 at 7:48
  • In point of fact redhat did it before debian and canonical. Some Debian or Ubuntu enthusiast blogged raging about it and calling the decision retarded. I had to make this explanation to them, and explain that they shouldn't call a decision retarded without understanding the Why. If I wanted to use something like Jugaad in an offensive environment, it would be with some LD-PRELOAD tweak to inject a tiny .so in to every process and wait for one of them to escalate to root. Then flip the switch for me. So all I had to do is wait. – RobotHumans Jul 22 '14 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.