MediumOS hardeningBLWK-KERNEL-001

ptrace scope allows tracing sibling processes

What this means

ptrace is unrestricted: kernel.yama.ptrace_scope is 0 (or the Yama LSM isn't loaded at all, which the collector reports the same way, since without Yama there is no restriction to begin with). Any process can attach to and read the memory of any other process owned by the same user — including credential-scraping via /proc/<pid>/mem, a documented credential-access technique.

How to fix it

Set kernel.yama.ptrace_scope=1 via /etc/sysctl.d/ and run sysctl --system.

Check it yourself

Run a scan and look for BLWK-KERNEL-001 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads sysctl_kernel and reports this check when:

ptrace_scope == 0

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1003.007

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001