Configure the Kernel Parameter ptrace_scope Properly

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

# ------------------------------------------------------------------
# METADATA
# ------------------------------------------------------------------

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.130340");
  script_version("2025-11-21T05:40:28+0000");
  script_tag(name:"last_modification", value:"2025-11-21 05:40:28 +0000 (Fri, 21 Nov 2025)");
  script_tag(name:"creation_date", value:"2025-05-07 11:44:20 +0000 (Wed, 07 May 2025)");
  script_tag(name:"cvss_base", value:"0.0");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:H/Au:S/C:N/I:N/A:N");
  script_tag(name:"qod", value:"97");

  script_name("Configure the Kernel Parameter ptrace_scope Properly");

  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Policy");
  script_dependencies("compliance_tests.nasl", "compliance_os_check.nasl");

  script_mandatory_keys("Compliance/Launch", "policy/ssh/login/euleros_eulerosvirtual_openeuler_hce");

  script_xref(name:"Policy", value:"EulerOS Baseline: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.5 Kernel: 3.5.22 Configure the Kernel Parameter ptrace_scope Properly (Recommendation)");
  script_xref(name:"Policy", value:"EulerOS Virtual: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.5 Kernel: 3.5.22 Configure the Kernel Parameter ptrace_scope Properly (Recommendation)");
  script_xref(name:"Policy", value:"HCE Linux (Huawei Cloud EulerOS): openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.5 Kernel: 3.5.22 Configure the Kernel Parameter ptrace_scope Properly (Recommendation)");
  script_xref(name:"Policy", value:"openEuler Baseline: openEuler Security Configuration Baseline (v1.0.0): 3. Running and Services: 3.5 Kernel: 3.5.22 Configure the Kernel Parameter ptrace_scope Properly (Recommendation)");

  script_tag(name:"summary", value:"ptrace is a system call used for process tracing. It provides
the capability for a parent process to observe and control child processes. Linux Kernel 3.4 and
later versions support completely restricting or disabling the ptrace function. According to the
Linux Kernel Yama Documentation, the following parameters can be selected for ptrace_scope:

0: The process can transfer PTRACE_ATTACH to any other process as long as it is dumpable (no UID is
converted, no privilege is started, or prctl is called).

1 = To call PTRACE_ATTACH, a process must have a predefined relationship. By default, when the
preceding conditions are met, the predefined relationship only works for child processes. To change
the relationship, the child processes can call prctl.

2 = Only processes with CAP_SYS_PTRACE can use ptrace by calling PTRACE_TRACEME through child
processes to PTRACE_ATTACH.

3 = No process can use ptrace with PTRACE_ATTACH or through PTRACE_TRACEME.

The default value of this parameter for openEuler is 0. You can set this parameter based on the
actual application scenario. The recommended value is 2.");

  exit(0);
}

include("ssh_func.inc");
include("host_details.inc");
include("policy_reporting_module.inc");

title = "Configure the Kernel Parameter ptrace_scope Properly";

solution = "1. Run the following command to temporarily set the value of ptrace_scope. After the
reboot, the default value is restored.

# echo 2 > /proc/sys/kernel/yama/ptrace_scope

Or

# sysctl -w kernel.randomize_va_space=2

2. Open the /etc/sysctl.conf file, add or modify the following configuration, and run the sysctl -p
/etc/sysctl.conf command to make the configuration take effect permanently.

kernel.yama.ptrace_scope=2";

check_type = "SSH_Cmd";

action = 'Run the command in the terminal:
# sysctl kernel.yama.ptrace_scope';

expected_value = 'The output should be equal to "kernel.yama.ptrace_scope = 2"';

# ------------------------------------------------------------------
# CONNECTION CHECK
# ------------------------------------------------------------------

if(!get_kb_item("login/SSH/success") || !sock = ssh_login_or_reuse_connection()){

  report_ssh_error(title: title,
                   solution: solution,
                   action: action,
                   expected_value: expected_value,
                   check_type: check_type);
  exit(0);
}

# ------------------------------------------------------------------
# CHECK : Verify command `sysctl kernel.yama.ptrace_scope`
# ------------------------------------------------------------------

step_cmd = 'sysctl kernel.yama.ptrace_scope';
actual_value = ssh_cmd(socket:sock, cmd:step_cmd, return_errors:TRUE, return_linux_errors_only:TRUE);

if(eregmatch(string: actual_value, pattern:"(No such file or directory|Permission denied|Command not found|Segmentation fault|service not found|is not running|syntax error near unexpected token|syntax error: unexpected end of file)", icase: TRUE)){
  compliant = "incomplete";
  comment = "Something went wrong during the audit check. Please try again.";
}else if(actual_value == 'kernel.yama.ptrace_scope = 2'){
  compliant = "yes";
  comment = "Check passed";
}else{
  compliant = "no";
  comment = "Check failed";
}

# ------------------------------------------------------------------
# REPORT
# ------------------------------------------------------------------

target = get_kb_item("policy/ssh/login/os-release");
comment = "Target: " + target + "\n" + comment;

report_audit(action: action,
             actual_value: actual_value,
             expected_value: expected_value,
             is_compliant: compliant,
             solution: solution,
             check_type: check_type,
             title: title,
             comment: comment);

exit(0);