# Ensure ptrace_scope is restricted

Necessity: The 'ptrace' system call allows one process to observe and control the execution of another process, including examining and modifying its memory and registers. This is essential for debugging tools like 'gdb' and 'strace'. However, if left unrestricted, it can be exploited by malicious code to attach to legitimate processes (e.g., web browsers, SSH clients) and steal sensitive information like passwords or session tokens directly from memory. Restricting 'ptrace_scope' is a critical process hardening measure that mitigates this risk by limiting which processes can be traced.

Auditing and Remediation: The audit script checks the current value of the 'kernel.yama.ptrace_scope' parameter to determine the level of restriction. The remediation script modifies this kernel parameter in the live system and updates the '/etc/sysctl.d/' configuration to make the setting persistent after a reboot.

Recommended State Rationale:
- Basic: A value of '[1, 1]' is the widely accepted baseline (e.g., CIS Benchmark). It restricts ptrace to direct parent processes, preventing unrelated malicious processes from attaching while still allowing standard debugging of child processes.
- Moderate: A value of '[2, 2]' provides a stricter configuration by restricting ptrace usage to only processes with the 'CAP_SYS_PTRACE' capability, which typically means only administrators (root). This is suitable for production servers where debugging by non-privileged users is not required.
- Strict: A value of '[3, 3]' completely disables ptrace system-wide. This offers the highest level of security against ptrace-based attacks but may break legitimate debugging and diagnostic tools. It should be used on highly sensitive, single-purpose systems where no process tracing is anticipated.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[1, 3]` |
| **Moderate** | `[2, 3]` |
| **Strict** | `[3, 3]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that queries the current value of the 'kernel.yama.ptrace_scope' kernel parameter. The script must use 'sysctl -n kernel.yama.ptrace_scope' to retrieve the value and output only the numerical result with no extra text or labels.

## Remediation Script Working

Bash script that accepts a single numerical value as a positional command-line argument. The script must set the 'kernel.yama.ptrace_scope' parameter to this value in the running configuration using 'sysctl -w' and also ensure it persists across reboots by adding or modifying the entry in a file under '/etc/sysctl.d/'. The script must return 'true' on success and 'false' on failure.

