From 13c7083bc028616e258e5e6919db7b11c6e739a6 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 20 Aug 2025 00:27:45 +0900 Subject: container: ptrace protection via Yama LSM This is only a nice to have feature as the init process has no additional privileges and the monitor process was never reachable anyway. Closes #4. Signed-off-by: Ophestra --- container/init.go | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'container/init.go') diff --git a/container/init.go b/container/init.go index 885b543d..0f888fad 100644 --- a/container/init.go +++ b/container/init.go @@ -55,6 +55,11 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) { log.Fatal("this process must run as pid 1") } + if err := SetPtracer(0); err != nil { + msg.Verbosef("cannot enable ptrace protection via Yama LSM: %v", err) + // not fatal: this program has no additional privileges at initial program start + } + var ( params initParams closeSetup func() error -- cgit v1.3.1