cis-ubuntu1804-v220-1-5-1

name	cis-ubuntu1804-v220-1-5-1
description	Ensure ptrace_scope is restricted
category	cis-storage
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","ptrace","process-hardening","kernel"]
cis_id	1.5.1
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

1.5.1 Ensure ptrace_scope is restricted (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

The ptrace() system call provides a means by which one process (the "tracer") may observe and control the execution of another process (the "tracee"), and examine and change the tracee's memory and registers.

Rationale

If one application is compromised, it would be possible for an attacker to attach to other running processes (e.g. Bash, Firefox, SSH sessions, GPG agent, etc) to extract additional credentials and continue to expand the scope of their attack.

Enabling restricted mode will limit the ability of a compromised process to PTRACE_ATTACH on other processes running under the same user. With restricted mode, ptrace will continue to work with root user.

Audit Procedure

Command Line

Run the following script to verify the following kernel parameter is set in the running configuration and correctly loaded from a kernel parameter configuration file:

• kernel.yama.ptrace_scope is set to 1

Note: kernel parameters are loaded by file and parameter order precedence. The following script observes this precedence as part of the auditing procedure. The parameters being checked may be set correctly in a file. If that file is superseded, the parameter is overridden by an incorrect setting later in that file, or in a canonically later file, that "correct" setting will be ignored both by the script and by the system during a normal kernel parameter load sequence.

#!/usr/bin/env bash
{
    l_output="" l_output2=""
    a_parlist=("kernel.yama.ptrace_scope=1")
    l_ufwscf="$([ -f /etc/default/ufw ] && awk -F= '/^\s*IPT_SYSCTL=/ {print $2}' /etc/default/ufw)"
    a_searchpath=("/run/sysctl.d/" "/etc/sysctl.d/" "/usr/local/lib/sysctl.d/" "/usr/lib/sysctl.d/" "/lib/sysctl.d/")
    unset A_files
    declare -A A_files # Array of "valid" files
    A_files+=(["sysctl.conf"]="/etc/sysctl.conf")
    for l_searchpath  ; 
         [ -d  ]; 
             IFS=  -r -d $ l_filename; 
                 [ -f  ]; 
                    l_basename=
                     [ -z  ]; 
                        A_files+=([]=)
                    
                
             < <(find  - f -name  -print0)
        
    
    a_sorted=()
     IFS=  -rd  l_key; 
        a_sorted+=(  )
     < <(   |  -rz)
    ()
    {
        l_var= l_var2=
        l_krp= 
         [  =  ]; 
            l_output=
        
            l_output2=
        
    }
     IFS=  -r l_kpname l_kpvalue; 
        l_kpname=; l_kpvalue=
         ! grep -Pqs  /sys/module/ipv6/parameters/disable && grep -q  <<< ; 
            l_output=
        
            kernel_parameter_chk
        
     < <(  )
     A_files;  a_sorted 
     [ -z  ];  
         -e 
    
         -e 
        [ -n  ] &&  -e 
    
}