Yama: add PR_SET_PTRACER_ANY
For a process to entirely disable Yama ptrace restrictions, it can use the special PR_SET_PTRACER_ANY pid to indicate that any otherwise allowed process may ptrace it. This is stronger than calling PR_SET_PTRACER with pid "1" because it includes processes in external pid namespaces. This is currently needed by the Chrome renderer, since its crash handler (Breakpad) runs external to the renderer's pid namespace. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
@@ -119,5 +119,6 @@
|
||||
* A value of 0 mean "no process".
|
||||
*/
|
||||
#define PR_SET_PTRACER 0x59616d61
|
||||
# define PR_SET_PTRACER_ANY ((unsigned long)-1)
|
||||
|
||||
#endif /* _LINUX_PRCTL_H */
|
||||
|
||||
Reference in New Issue
Block a user