FM / help

/usr/lib/python3.6/site-packages/sepolicy/help/

/usr/lib/python3.6/site-packages/sepolicy/help

Name	Size	Mode	Actions
__pycache__/	-	0755	rm
booleans.png	72749	0644	edit dl rm
booleans.txt	478	0644	edit dl rm
booleans_more.png	62348	0644	edit dl rm
booleans_more.txt	193	0644	edit dl rm
booleans_more_show.png	34948	0644	edit dl rm
booleans_more_show.txt	62	0644	edit dl rm
booleans_toggled.png	61958	0644	edit dl rm
booleans_toggled.txt	310	0644	edit dl rm
files_apps.png	81978	0644	edit dl rm
files_apps.txt	563	0644	edit dl rm
files_exec.png	67866	0644	edit dl rm
files_exec.txt	398	0644	edit dl rm
files_write.png	77773	0644	edit dl rm
files_write.txt	567	0644	edit dl rm
file_equiv.png	49221	0644	edit dl rm
file_equiv.txt	1181	0644	edit dl rm
lockdown.png	50599	0644	edit dl rm
lockdown.txt	291	0644	edit dl rm
lockdown_permissive.png	30025	0644	edit dl rm
lockdown_permissive.txt	722	0644	edit dl rm
lockdown_ptrace.png	29336	0644	edit dl rm
lockdown_ptrace.txt	1249	0644	edit dl rm
lockdown_unconfined.png	27473	0644	edit dl rm
lockdown_unconfined.txt	867	0644	edit dl rm
login.png	40102	0644	edit dl rm
login.txt	786	0644	edit dl rm
login_default.png	41680	0644	edit dl rm
login_default.txt	507	0644	edit dl rm
ports_inbound.png	58994	0644	edit dl rm
ports_inbound.txt	336	0644	edit dl rm
ports_outbound.png	52979	0644	edit dl rm
ports_outbound.txt	346	0644	edit dl rm
start.png	14128	0644	edit dl rm
start.txt	505	0644	edit dl rm
system.png	50601	0644	edit dl rm
system.txt	81	0644	edit dl rm
system_boot_mode.png	52674	0644	edit dl rm
system_boot_mode.txt	458	0644	edit dl rm
system_current_mode.png	52641	0644	edit dl rm
system_current_mode.txt	344	0644	edit dl rm
system_export.png	53210	0644	edit dl rm
system_export.txt	416	0644	edit dl rm
system_policy_type.png	54631	0644	edit dl rm
system_policy_type.txt	410	0644	edit dl rm
system_relabel.png	52867	0644	edit dl rm
system_relabel.txt	399	0644	edit dl rm
transition_file.png	69779	0644	edit dl rm
transition_file.txt	1050	0644	edit dl rm
transition_from.png	63231	0644	edit dl rm
transition_from.txt	619	0644	edit dl rm
transition_from_boolean.png	67329	0644	edit dl rm
transition_from_boolean.txt	463	0644	edit dl rm
transition_from_boolean_1.png	71717	0644	edit dl rm
transition_from_boolean_1.txt	235	0644	edit dl rm
transition_from_boolean_2.png	32219	0644	edit dl rm
transition_from_boolean_2.txt	132	0644	edit dl rm
transition_to.png	58909	0644	edit dl rm
transition_to.txt	605	0644	edit dl rm
users.png	57622	0644	edit dl rm
users.txt	814	0644	edit dl rm
__init__.py	0	0644	edit dl rm

Edit: /usr/lib/python3.6/site-packages/sepolicy/help/lockdown_ptrace.txt (1249B)

Disable ptrace capability on your system.

The deny_ptrace feature allows an administrator to toggle the ability of processes on the computer system from examining other processes on the system, including user processes.   It can even block processes running as root.

Most people do not realize that any program they run can examine the memory of any other process run by them.  Meaning the computer game you are running on your desktop can watch everything going on in Firefox or a programs like pwsafe or kinit or other program that attempts to hide passwords..

SELinux defines this access as ptrace and sys_ptrace.  These accesses allow one process to read the memory of another process.   ptrace allows developers and administrators to debug how a process is running using tools like strace, ptrace and gdb.    You can even use gdb (GNU Debugger to manipulate another process running memory and environment.

The problem is this is allowed by default.

My wife does not debug programs, why is she allowed to debug them?  As a matter of fact most of the time, I am not debugging applications, so it would be more secure if we could disable it by default.

Note: Disabling ptrace can break some bug trappers that attempt to collect crash data.

Disable ptrace capability on your system. The deny_ptrace feature allows an administrator to toggle the ability of processes on the computer system from examining other processes on the system, including user processes. It can even block processes running as root. Most people do not realize that any program they run can examine the memory of any other process run by them. Meaning the computer game you are running on your desktop can watch everything going on in Firefox or a programs like pwsafe or kinit or other program that attempts to hide passwords.. SELinux defines this access as ptrace and sys_ptrace. These accesses allow one process to read the memory of another process. ptrace allows developers and administrators to debug how a process is running using tools like strace, ptrace and gdb. You can even use gdb (GNU Debugger to manipulate another process running memory and environment. The problem is this is allowed by default. My wife does not debug programs, why is she allowed to debug them? As a matter of fact most of the time, I am not debugging applications, so it would be more secure if we could disable it by default. Note: Disabling ptrace can break some bug trappers that attempt to collect crash data.