From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 6773 invoked by alias); 8 Mar 2012 16:43:59 -0000 Received: (qmail 6762 invoked by uid 22791); 8 Mar 2012 16:43:56 -0000 X-SWARE-Spam-Status: No, hits=-6.9 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_HI,SPF_HELO_PASS,T_RP_MATCHES_RCVD X-Spam-Check-By: sourceware.org Received: from mx1.redhat.com (HELO mx1.redhat.com) (209.132.183.28) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Thu, 08 Mar 2012 16:43:37 +0000 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q28GhaHd029674 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Thu, 8 Mar 2012 11:43:36 -0500 Received: from barimba (ovpn01.gateway.prod.ext.phx2.redhat.com [10.5.9.1]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q28GhZru022195 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Thu, 8 Mar 2012 11:43:36 -0500 From: Tom Tromey To: Jan Kratochvil Cc: gdb-patches@sourceware.org Subject: Re: [suspend] [patch 3/3] attach-fail-reasons: SELinux deny_ptrace References: <20120306061739.GC24004@host2.jankratochvil.net> <20120308065319.GA15742@host2.jankratochvil.net> Date: Thu, 08 Mar 2012 16:43:00 -0000 In-Reply-To: <20120308065319.GA15742@host2.jankratochvil.net> (Jan Kratochvil's message of "Thu, 8 Mar 2012 07:53:19 +0100") Message-ID: <87d38nnivc.fsf@fleche.redhat.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.0.94 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2012-03/txt/msg00271.txt.bz2 >>>>> "Jan" == Jan Kratochvil writes: Jan> On Tue, 06 Mar 2012 07:17:39 +0100, Jan Kratochvil wrote: >> and here is the last bit for new SELinux 'deny_ptrace': >> https://bugzilla.redhat.com/show_bug.cgi?id=786878 Jan> FYI going to keep this patch off-trunk for a while as 'deny_ptrace' is not Jan> going to restrict PTRACE_TRACEME. Therefore the GDB patch no longer has to Jan> protect against failing PTRACE_TRACEME. This does simplify the GDB patch. Jan> I will wait till the SELinux kernel 'deny_ptrace' restrictions settle down. I wonder whether ptrace-hardening approaches other than SELinux still have restrictions on PTRACE_TRACEME. If so then you may want a similar patch anyhow. Tom