Skip to content
Snippets Groups Projects

hardening: use default ptrace scope on buildservers

Merged hardening: use default ptrace scope on buildservers
remove-ptrace-hardening-from-buildservers into master
Merged Evangelos Foutras requested to merge remove-ptrace-hardening-from-buildservers into master
Viewing commit f6cbd3f8
Show latest version
1 file
+ 1
− 0
Compare changes
  • Side-by-side
  • Inline
  • f6cbd3f8 
    Making 'kernel.yama.ptrace_scope' more strict by setting it to '2'
causes failures in elfutils' test suite. While tentatively helpful
on other servers, it seems kind of unnecessary for a build server.

Fixes: #424 (to be reopened though, if more restrictions are found)
roles/hardening/tasks/main.yml
+ 1
− 0
@@ -7,6 +7,7 @@
- name: set ptrace scope, restrict ptrace to CAP_SYS_PTRACE
copy: src=50-ptrace-restrict.conf dest=/etc/sysctl.d/50-ptrace-restrict.conf owner=root group=root mode=0644
when: "'buildservers' not in group_names"
notify:
- apply sysctl settings