Piecuu/pmaports
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

kconfigcheck: Require support for Yama

Browse source 
This lets us prohibit non-ancestor ptrace access to running processes
and their credentials via sysctl kernel.yama.ptrace_scope=1.

Yama stacks correctly with SELinux. Arch Linux enables it and sets
ptrace_scope=1 by default, see https://wiki.archlinux.org/title/Security#ptrace_scope.

Note that SELinux also has the deny_ptrace mechanism to achieve similar
things, but we're not shipping SELinux at the moment and we can opt to
switch to deny_ptrace for enforcing this in the future if desired.

See https://docs.kernel.org/admin-guide/LSM/Yama.html for more information.

Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8582>
This commit is contained in:
Aelin 2026-05-17 09:47:57 +02:00 • committed by The Friendly Meow (merge) Bot
parent e1bc923bdb
commit 4402d4a28e
No known key found for this signature in database
1 changed files with 1 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
kconfigcheck.toml
View file

@ -648,6 +648,7 @@ DM_VERITY = "m"
["category:hardening".">=0.0.0"."all"]
SECURITY_DMESG_RESTRICT = "y"
SECURITY_YAMA = "y"
# In 6.18+, CFI_CLANG is CFI
["category:hardening".">=6.18_rc1"."x86_64 aarch64 armv7 riscv64"]