[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 5086ed681da4784474f0f71aaa70ec1d4940897c

["Peter Müller" <git@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 1687 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  5086ed681da4784474f0f71aaa70ec1d4940897c (commit)
      from  2fcfe2e1f339c868b5800b61433c803023686371 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5086ed681da4784474f0f71aaa70ec1d4940897c
Author: Peter Müller <peter.mueller(a)ipfire.org>
Date:   Wed Jun 29 19:43:08 2022 +0000

    sysctl: Permit ptrace usage for processes with CAP_SYS_PTRACE
    
    https://lists.ipfire.org/pipermail/development/2022-June/013763.html
    
    Reported-by: Michael Tremer <michael.tremer(a)ipfire.org>
    Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/etc/sysctl.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Difference in files:
diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf
index 4d4f765ea..31a220e38 100644
--- a/config/etc/sysctl.conf
+++ b/config/etc/sysctl.conf
@@ -109,5 +109,5 @@ kernel.core_uses_pid = 1
 # Block non-uid-0 profiling
 kernel.perf_event_paranoid = 3
 
-# Deny any ptrace use as there is no legitimate use-case for it on IPFire
-kernel.yama.ptrace_scope = 3
+# Only processes with CAP_SYS_PTRACE may use ptrace
+kernel.yama.ptrace_scope = 2


hooks/post-receive
--
IPFire 2.x development tree