yama: Disable ptrace restrictions by default, and change boot message to indicate this (Closes: #712740)

svn path=/dists/sid/linux/; revision=20261

debian/changelog

@@ -1,3 +1,10 @@
+linux (3.9.6-2) UNRELEASED; urgency=low
+
+  * yama: Disable ptrace restrictions by default, and change boot message
+    to indicate this (Closes: #712740)
+
+ -- Ben Hutchings <ben@decadent.org.uk>  Wed, 19 Jun 2013 04:30:59 +0100
+
 linux (3.9.6-1) unstable; urgency=low
 
   * New upstream stable update:

debian/patches/debian/yama-disable-by-default.patch

@@ -0,0 +1,26 @@
+From: Ben Hutchings <ben@decadent.org.uk>
+Subject: yama: Disable by default
+Date: Wed, 19 Jun 2013 04:35:28 +0100
+Bug-Debian: http://bugs.debian.org/712740
+Forwarded: not-needed
+
+--- a/security/yama/yama_lsm.c
++++ b/security/yama/yama_lsm.c
+@@ -24,7 +24,7 @@
+ #define YAMA_SCOPE_CAPABILITY	2
+ #define YAMA_SCOPE_NO_ATTACH	3
+ 
+-static int ptrace_scope = YAMA_SCOPE_RELATIONAL;
++static int ptrace_scope = YAMA_SCOPE_DISABLED;
+ 
+ /* describe a ptrace relationship for potential exception */
+ struct ptrace_relation {
+@@ -425,7 +425,7 @@ static __init int yama_init(void)
+ 		return 0;
+ #endif
+ 
+-	printk(KERN_INFO "Yama: becoming mindful.\n");
++	printk(KERN_INFO "Yama: disabled by default; enable with sysctl kernel.yama.*\n");
+ 
+ #ifndef CONFIG_SECURITY_YAMA_STACKED
+ 	if (register_security(&yama_ops))

debian/patches/series

@@ -107,3 +107,4 @@ features/arm/0001-ARM-mvebu-Add-thermal-support-to-Armada-XP-device-tr.patch
 bugfix/all/ath9k-Disable-PowerSave-by-default.patch
 bugfix/x86/viafb-autoload-on-olpc-xo1.5-only.patch
 debian/powerpc-machdep-avoid-abi-change-in-3.9.6.patch
+debian/yama-disable-by-default.patch