From 13c7083bc028616e258e5e6919db7b11c6e739a6 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 20 Aug 2025 00:27:45 +0900 Subject: container: ptrace protection via Yama LSM This is only a nice to have feature as the init process has no additional privileges and the monitor process was never reachable anyway. Closes #4. Signed-off-by: Ophestra --- container/syscall.go | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'container/syscall.go') diff --git a/container/syscall.go b/container/syscall.go index 62b85c55..8fb41e7d 100644 --- a/container/syscall.go +++ b/container/syscall.go @@ -9,6 +9,14 @@ const ( SUID_DUMP_USER ) +func SetPtracer(pid uintptr) error { + _, _, errno := syscall.Syscall(syscall.SYS_PRCTL, syscall.PR_SET_PTRACER, pid, 0) + if errno == 0 { + return nil + } + return errno +} + func SetDumpable(dumpable uintptr) error { // linux/sched/coredump.h if _, _, errno := syscall.Syscall(syscall.SYS_PRCTL, syscall.PR_SET_DUMPABLE, dumpable, 0); errno != 0 { -- cgit v1.3.1