diff options
| author | Eelco Dolstra <edolstra@gmail.com> | 2017-03-21 18:41:58 +0100 |
|---|---|---|
| committer | Eelco Dolstra <edolstra@gmail.com> | 2017-03-21 18:48:35 +0100 |
| commit | 86721a5f78718caf10c578e9501f8b4d19c0eb44 (patch) | |
| tree | 843681352ebaaefd782e1478be5892c1a5b5e2a6 /nixos/modules/config | |
| parent | 78bb734452a76c7719f2224e5add5b2a12b3fbf6 (diff) | |
| download | nixpkgs-86721a5f78718caf10c578e9501f8b4d19c0eb44.tar nixpkgs-86721a5f78718caf10c578e9501f8b4d19c0eb44.tar.gz nixpkgs-86721a5f78718caf10c578e9501f8b4d19c0eb44.tar.bz2 nixpkgs-86721a5f78718caf10c578e9501f8b4d19c0eb44.tar.lz nixpkgs-86721a5f78718caf10c578e9501f8b4d19c0eb44.tar.xz nixpkgs-86721a5f78718caf10c578e9501f8b4d19c0eb44.tar.zst nixpkgs-86721a5f78718caf10c578e9501f8b4d19c0eb44.zip | |
Allow attaching to non-child processes by default
The inability to run strace or gdb is the kind of developer-unfriendliness that we're used to from OS X, let's not do it on NixOS. This restriction can be re-enabled by setting boot.kernel.sysctl."kernel.yama.ptrace_scope" = 1; It might be nice to have a NixOS module for enabling hardened defaults. Xref #14392. Thanks @abbradar.
Diffstat (limited to 'nixos/modules/config')
| -rw-r--r-- | nixos/modules/config/sysctl.nix | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/nixos/modules/config/sysctl.nix b/nixos/modules/config/sysctl.nix index 61b02c5ffa6..a3f7e8f722f 100644 --- a/nixos/modules/config/sysctl.nix +++ b/nixos/modules/config/sysctl.nix @@ -64,5 +64,9 @@ in # Removed under grsecurity. boot.kernel.sysctl."kernel.kptr_restrict" = if (config.boot.kernelPackages.kernel.features.grsecurity or false) then null else 1; + + # Disable YAMA by default to allow easy debugging. + boot.kernel.sysctl."kernel.yama.ptrace_scope" = mkDefault 0; + }; } |