Better document ptrace issue and solution on Linux

[GoogleCodeExporter]

Several issues are about the ptrace hardening of actual distributions. 

All sites mentioned in the comments simply say: Turn this protection off 
completely by doing 

    echo 0 > /proc/sys/kernel/yama/ptrace_scope

as the root user.

The better solution is not to open the barn door but to simply give 
DwarfTherapist the required capability CAP_SYS_PTRACE like this:

    sudo setcap cap_sys_ptrace=ep DwarfTherapist

Then DwarfTherapist does not require root privileges and the ptrace hardening 
is still active on most binaries.

Original issue reported on code.google.com by ashei...@gmail.com on 22 Sep 2012 at 9:34

[GoogleCodeExporter]

I tried this solution but it didn't work for me. It still only runs if i run DT 
as root. getcap says, that the property is set, though:

[mike@Nilar dwarftherapist]$ getcap bin/release/DwarfTherapist 
bin/release/DwarfTherapist = cap_sys_ptrace+ep

Original comment by haertl.mike@gmail.com on 30 Dec 2012 at 10:42

[GoogleCodeExporter]

If you must start DwarfTherapist as root then I think something else than the 
ptrace permission is missing. 

To verify this try setting "ptrace_scope" to "0" (as the root user) and start 
DwarfTherapist as the normal user. If it works now then "setcap" does not work 
properly. In that case you must check your kernel version and distribution. 

But if it still does not work the my assumption holds. In that case I don't 
known what additional capabilities are required. But you can check the 
capabilities(7) manpage and do a binary search :-)

Original comment by ashei...@gmail.com on 30 Dec 2012 at 4:43

[GoogleCodeExporter]

If i set ptrace_scope to 0 it works. But i agree, that this is a very bad 
solution.

Actually i don't think, that setcap is not working correctly (see the output of 
getcap above). The permission is set correctly but i still see:

  ptrace attach: Operation not permitted

when i try to star DT. BTW i'm on latest Ubuntu (12.10 with 3.5.0-21-generic) 
so i also don't think, that this is a kernel bug or due to a too old system.

Original comment by haertl.mike@gmail.com on 31 Dec 2012 at 3:22