Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix bug in disable_ptrace action to allow sysctl to disable ptrace. #2313

Merged
merged 1 commit into from
Jun 19, 2023

Conversation

dreambeyondorange
Copy link
Contributor

Previously the setting for Ubuntu systems was not getting used due to a misalignment between the cookbook and cli. On the cli, node['cluster']['enable_efa'] was set to 'efa' in the dna.json file, but the cookbook assumed the parameter was set to 'compute'. This causes the disable_ptrace action if clause to be skipped. This page describes the use of sysctl https://manpages.ubuntu.com/manpages/bionic/man5/sysctl.conf.5.html This page describes the function of the ptrace_scope parameter https://www.kernel.org/doc/Documentation/security/Yama.txt Chef actually generates a config file in /etc/sysctl.d/ for the parameter that is changed so it should persist. https://docs.chef.io/resources/sysctl/

Tests

  • Manual kitchen tests in develop

Checklist

  • Make sure you are pointing to the right branch and add a label in the PR title (i.e. 2.x vs 3.x)
  • Check all commits' messages are clear, describing what and why vs how.
  • Make sure to have added unit tests or integration tests to cover the new/modified code.
  • Check if documentation is impacted by this change.

Please review the guidelines for contributing and Pull Request Instructions.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Previously the setting for Ubuntu systems was not getting used due to a misalignment between the cookbook and cli.
On the cli, node['cluster']['enable_efa'] was set to 'efa' in the dna.json file, but the cookbook assumed the
parameter was set to 'compute'.  This causes the disable_ptrace action if clause to be skipped.
This page describes the use of sysctl https://manpages.ubuntu.com/manpages/bionic/man5/sysctl.conf.5.html
This page describes the function of the ptrace_scope parameter https://www.kernel.org/doc/Documentation/security/Yama.txt
Chef actually generates a config file in /etc/sysctl.d/ for the parameter that is changed so it should persist.
https://docs.chef.io/resources/sysctl/
@dreambeyondorange dreambeyondorange requested review from a team as code owners June 19, 2023 16:39
@codecov
Copy link

codecov bot commented Jun 19, 2023

Codecov Report

Merging #2313 (f5f0e5a) into release-3.6 (7c85f17) will not change coverage.
The diff coverage is n/a.

@@             Coverage Diff              @@
##           release-3.6    #2313   +/-   ##
============================================
  Coverage        70.01%   70.01%           
============================================
  Files               13       13           
  Lines             1834     1834           
============================================
  Hits              1284     1284           
  Misses             550      550           
Flag Coverage Δ
unittests 70.01% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

@dreambeyondorange dreambeyondorange enabled auto-merge (squash) June 19, 2023 17:16
@dreambeyondorange dreambeyondorange merged commit 990354b into aws:release-3.6 Jun 19, 2023
25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants