7

I would like to be able to attach to a process with gdb. The process has my uid, but the executable file is set-gid. So, apparently, I'm learning about PAM. It's my understanding any process attaching to a set-gid process needs CAP_SYS_PTRACE (or to be the superuser).

Just in case there's any question:

$ cat /proc/sys/kernel/yama/ptrace_scope
0

Following advice in pam_cap(8), I looked for /etc/security/capabilities.conf. On LTS 16 that doesn't exist, but the directory does, so I created the file:

CAP_SYS_PTRACE jklowden

I also appended this to /etc/pam.d/common-auth:

# Cf. advice in pam_cap(8)
auth      optional        pam_cap.so

Yet a new login cannot attach to the set-gid process.

  1. How to display capabilities of a process?
  2. Do I have to restart pam, or something? How?
  3. Is there another file that needs massaging before this will work?
  4. Where is a better place to learn about such things?

Rant: sudo -g $gid -p $pid is no help. As the fine manual says, unprivileged processes cannot trace processes that they cannot send signals to or those running set-user-ID/set-group-ID programs, for obvious reasons. It's not actually obvious why I shouldn't be able to trace a process I own from a process in the same group, simply because the file is marked set-group-ID. The policy encourages debugging as the superuser, which is undeniably less secure. [end rant]

0

You must log in to answer this question.

Browse other questions tagged .