# Ensure ptrace_scope is restricted

The ptrace system call allows one process to observe and control the execution of another process, which is essential for debuggers and diagnostic tools. However, it can be abused by malicious software to inspect the memory of other running applications, potentially stealing credentials, encryption keys, or other sensitive data. Restricting the ptrace scope is a critical process hardening measure that mitigates this threat by limiting which processes can use ptrace on others. The audit script checks the current value of the 'kernel.yama.ptrace_scope' parameter. The remediation script sets this value for the live system and makes the change persistent across reboots by writing it to a sysctl configuration file. A Basic state of '1' (restricted ptrace) is recommended as it prevents processes from attaching to arbitrary processes run by the same user, which is a significant improvement over the classic model ('0') with minimal impact on functionality. A Moderate state of '2' (admin-only) enhances security by allowing only privileged processes (with CAP_SYS_PTRACE) to use ptrace, suitable for production servers. A Strict state of '3' (no attach) completely disables ptrace, offering maximum protection but potentially breaking legitimate debugging and monitoring tools, and should only be used in highly sensitive environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[1, 3]` |
| **Moderate** | `[2, 3]` |
| **Strict** | `[3, 3]` |
| **Type** | `RANGE` |

## Audit Script Working

shell script that retrieves the current value of the 'kernel.yama.ptrace_scope' kernel parameter using the 'sysctl -n' command. The script must output only the numerical value and nothing else.

## Remediation Script Working

shell script that accepts a single numerical value as a command-line argument. The script should set the 'kernel.yama.ptrace_scope' parameter to this value both for the running session using 'sysctl -w' and persistently by adding or modifying the entry in a configuration file within '/etc/sysctl.d/'. The script must reload the sysctl configuration and return 'true' upon successful application, or 'false' if it fails.

