Turn the ptrace(2) syscall into a kernel compile option, option PTRACE in

your kernel configuration file.
By default, GENERIC will enable this.

When PTRACE is not enabled, several ptrace-like features of the procfs
filesystem will be disabled as well (namely, the ability to read and write
any process' registers, as well as attching, single stepping and detaching
to/from processes).

This should help paranoid people build better sandboxens, and us to build
smaller ramdisks.

2 files changed, 8 insertions, 2 deletions

diff --git a/sys/compat/linux/linux_dummy.c b/sys/compat/linux/linux_dummy.c
index 1e3d7c6247a..5f91d36b9c4 100644
--- a/sys/compat/linux/linux_dummy.c
+++ b/sys/compat/linux/linux_dummy.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: linux_dummy.c,v 1.6 2002/02/04 20:04:52 provos Exp $ */
+/*	$OpenBSD: linux_dummy.c,v 1.7 2002/03/14 00:42:25 miod Exp $ */
 
 /*-
  * Copyright (c) 1994-1995 Søren Schmidt
@@ -57,7 +57,9 @@ unsupported_msg(struct proc *p, const char *fname)
 }
 
 DUMMY(ostat);			/* #18 */
+#ifdef PTRACE
 DUMMY(ptrace);			/* #26 */
+#endif
 DUMMY(ofstat);			/* #28 */
 DUMMY(stty);			/* #31 */
 DUMMY(gtty);			/* #32 */
diff --git a/sys/compat/linux/syscalls.master b/sys/compat/linux/syscalls.master
index 4f82d6dffd6..14983087f82 100644
--- a/sys/compat/linux/syscalls.master
+++ b/sys/compat/linux/syscalls.master
@@ -1,4 +1,4 @@
-	$OpenBSD: syscalls.master,v 1.32 2002/02/04 20:04:52 provos Exp $
+	$OpenBSD: syscalls.master,v 1.33 2002/03/14 00:42:25 miod Exp $
 ;	$NetBSD: syscalls.master,v 1.15 1995/12/18 14:35:10 fvdl Exp $
 
 ;	@(#)syscalls.master	8.1 (Berkeley) 7/19/93
@@ -75,7 +75,11 @@
 23	NOARGS		linux_setuid16 { int sys_setuid(uid_t uid); }
 24	NOARGS		linux_getuid16 { uid_t sys_getuid(void); }
 25	STD		{ int linux_sys_stime(linux_time_t *t); }
+#ifdef PTRACE
 26	STD		{ int linux_sys_ptrace(void); }
+#else
+26	UNIMPL		ptrace
+#endif
 27	STD		{ int linux_sys_alarm(unsigned int secs); }
 28	STD		{ int linux_sys_ofstat(void); }
 29	STD		{ int linux_sys_pause(void); }