From 4402d4a28e1e8a535d26ba8deba16fe03600e1cf Mon Sep 17 00:00:00 2001 From: Aelin Date: Sun, 17 May 2026 09:47:57 +0200 Subject: [PATCH] kconfigcheck: Require support for Yama This lets us prohibit non-ancestor ptrace access to running processes and their credentials via sysctl kernel.yama.ptrace_scope=1. Yama stacks correctly with SELinux. Arch Linux enables it and sets ptrace_scope=1 by default, see https://wiki.archlinux.org/title/Security#ptrace_scope. Note that SELinux also has the deny_ptrace mechanism to achieve similar things, but we're not shipping SELinux at the moment and we can opt to switch to deny_ptrace for enforcing this in the future if desired. See https://docs.kernel.org/admin-guide/LSM/Yama.html for more information. Part-of: --- kconfigcheck.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/kconfigcheck.toml b/kconfigcheck.toml index a3915c8ad..bd916b74d 100644 --- a/kconfigcheck.toml +++ b/kconfigcheck.toml @@ -648,6 +648,7 @@ DM_VERITY = "m" ["category:hardening".">=0.0.0"."all"] SECURITY_DMESG_RESTRICT = "y" +SECURITY_YAMA = "y" # In 6.18+, CFI_CLANG is CFI ["category:hardening".">=6.18_rc1"."x86_64 aarch64 armv7 riscv64"]