social.noyu.me

tbh if i was making the default config for a server os i would disable /proc/xxx/mem. if you have rce but no privilege escalation there'd be lots of fun you could have with it otherwise

we have an answer! (it's https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace_Protection) https://twitter.com/eigenform/status/1779923196969418852

@hikari disabling proc self mem would also fix the one unfixable safety issue in Rust ;)

@hikari task_for_pid is actually kind of a good security model don’t @ me

@saagar i agree, i have some complaints but overall i think “system integrity protection” and related things are quite well-designed

@hikari If Apple ships AMFI Trusted Keys I will go back and like this

@saagar could you tell me more about what the hell that is

@hikari Image if you could be the root of trust on your machine

@hikari possibly related, there are some settings for turning off ptrace() that ubuntu enables by default, so maybe they did lock down all methods of leaking memory contents between processes running as the same non root user?

@hikari Yeah it’s become mindful

@slice @hikari This is actually the security model of all computers Apple just identifies it as something specific

@slice @hikari They do. Internally

@slice @hikari Skill issue

@saagar @slice what, do you have the skill

@hikari @slice No comment