Re: [PATCH] Kernel: Enable YAMA support

["Peter Müller" <peter.mueller@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 3915 bytes --]

Hello Michael,

thank you for reporting this.

Commit 5086ed681da4784474f0f71aaa70ec1d4940897c resolves the issue. As the sysctl value
cannot be decreased once it has been set to "3" (one of the few times where Linux seems
to actually show a mature approach to security by default), a reboot is required to apply
the change.

Thanks, and best regards,
Peter Müller


> I believe this stops strace from working. See screenshot.
> 
> If I remember our conversation correctly, this should have worked for root. Is my assumption correct?
> 
> -Michael
> 
> 
> 
>> On 13 Jun 2022, at 14:31, Michael Tremer <michael.tremer(a)ipfire.org> wrote:
>>
>> Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>
>>
>>> On 11 Jun 2022, at 19:53, Peter Müller <peter.mueller(a)ipfire.org> wrote:
>>>
>>> See https://www.kernel.org/doc/html/latest/admin-guide/LSM/Yama.html for
>>> the upstream rationale. Enabling YAMA gives us the benefit of additional
>>> hardening options available, without any obvious downsides.
>>>
>>> Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>
>>> ---
>>> config/kernel/kernel.config.aarch64-ipfire | 2 +-
>>> config/kernel/kernel.config.armv6l-ipfire  | 2 +-
>>> config/kernel/kernel.config.riscv64-ipfire | 2 +-
>>> config/kernel/kernel.config.x86_64-ipfire  | 2 +-
>>> 4 files changed, 4 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire
>>> index 6dfeae595..7e63b77ca 100644
>>> --- a/config/kernel/kernel.config.aarch64-ipfire
>>> +++ b/config/kernel/kernel.config.aarch64-ipfire
>>> @@ -7555,7 +7555,7 @@ CONFIG_FORTIFY_SOURCE=y
>>> # CONFIG_SECURITY_TOMOYO is not set
>>> # CONFIG_SECURITY_APPARMOR is not set
>>> # CONFIG_SECURITY_LOADPIN is not set
>>> -# CONFIG_SECURITY_YAMA is not set
>>> +CONFIG_SECURITY_YAMA=y
>>> # CONFIG_SECURITY_SAFESETID is not set
>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>> diff --git a/config/kernel/kernel.config.armv6l-ipfire b/config/kernel/kernel.config.armv6l-ipfire
>>> index 1bb745a87..1b6440b11 100644
>>> --- a/config/kernel/kernel.config.armv6l-ipfire
>>> +++ b/config/kernel/kernel.config.armv6l-ipfire
>>> @@ -7561,7 +7561,7 @@ CONFIG_HARDENED_USERCOPY_PAGESPAN=y
>>> # CONFIG_SECURITY_TOMOYO is not set
>>> # CONFIG_SECURITY_APPARMOR is not set
>>> # CONFIG_SECURITY_LOADPIN is not set
>>> -# CONFIG_SECURITY_YAMA is not set
>>> +CONFIG_SECURITY_YAMA=y
>>> # CONFIG_SECURITY_SAFESETID is not set
>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>> diff --git a/config/kernel/kernel.config.riscv64-ipfire b/config/kernel/kernel.config.riscv64-ipfire
>>> index 2d1fdbd28..2d6bb3a2c 100644
>>> --- a/config/kernel/kernel.config.riscv64-ipfire
>>> +++ b/config/kernel/kernel.config.riscv64-ipfire
>>> @@ -6193,7 +6193,7 @@ CONFIG_FORTIFY_SOURCE=y
>>> # CONFIG_SECURITY_TOMOYO is not set
>>> # CONFIG_SECURITY_APPARMOR is not set
>>> # CONFIG_SECURITY_LOADPIN is not set
>>> -# CONFIG_SECURITY_YAMA is not set
>>> +CONFIG_SECURITY_YAMA=y
>>> # CONFIG_SECURITY_SAFESETID is not set
>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>> diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire
>>> index b84698235..0efe14c41 100644
>>> --- a/config/kernel/kernel.config.x86_64-ipfire
>>> +++ b/config/kernel/kernel.config.x86_64-ipfire
>>> @@ -6971,7 +6971,7 @@ CONFIG_FORTIFY_SOURCE=y
>>> # CONFIG_SECURITY_TOMOYO is not set
>>> # CONFIG_SECURITY_APPARMOR is not set
>>> # CONFIG_SECURITY_LOADPIN is not set
>>> -# CONFIG_SECURITY_YAMA is not set
>>> +CONFIG_SECURITY_YAMA=y
>>> # CONFIG_SECURITY_SAFESETID is not set
>>> CONFIG_SECURITY_LOCKDOWN_LSM=y
>>> CONFIG_SECURITY_LOCKDOWN_LSM_EARLY=y
>>> -- 
>>> 2.35.3
>>
> 
>