[ALERT] ssh-keysign-pwn, unprivileged users are able to read root-owned files

[scotty65]

@LeakyMemory

What is says: “Excellent question, thank you very much! We have just now tried, and setting /proc/sys/kernel/yama/ptrace_scope to 2 (admin-only attach) or 3 (no attach) does in fact protect against all the exploits that we know of (but in theory at least other exploitation methods might exist).”

For anyone wanting to implement this mitigation at system boot, you should first create a file in /usr/bin/:

sudo touch /usr/bin/disable-yama-ptrace

Open the file in your favorite text editor (for example, Plasma users can open it with kate):

kate /usr/bin/disable-yama-ptrace

Add the following content to the file:

#!/usr/bin/env bash

echo 3 > /proc/sys/kernel/yama/ptrace_scope

exit 0

Note: you can also use echo 2 instead of echo 3, as per the above quoted text from @LeakyMemory

Then save the file (kate will prompt you for your password when you save it).

Make the file executable:

sudo chmod +x /usr/bin/disable-yama-ptrace

---

Next, create a systemd service file:

sudo touch /usr/lib/systemd/system/disable-yama-ptrace.service

Open that file in an editor (again, I’ll use Plasma’s kate for this example):

kate /usr/lib/systemd/system/disable-yama-ptrace.service

Add the following text to the service file:

[Unit]
Description=Disable ptrace access at boot

[Service]
Type=simple
ExecStart=/usr/bin/disable-yama-ptrace

[Install]
WantedBy=multi-user.target

Save the file (kate will ask for your password as it is a system file).

Then, enable the service and start it immediately:

systemctl enable --now disable-yama-ptrace

You will be prompted for your password as it is a system service. You should then see the following output in the terminal:

systemctl enable --now disable-yama-ptrace
Created symlink '/etc/systemd/system/multi-user.target.wants/disable-yama-ptrace.service' → '/usr/lib/systemd/system/disable-yama-ptrace.service'.

---

You should now be protected against the vulnerability. You can check by running the following command:

sysctl kernel.yama.ptrace_scope

The output should read:

❯ sysctl kernel.yama.ptrace_scope
kernel.yama.ptrace_scope = 3

As the service is enabled, it will now run automatically at boot. You can check the status by running the following command:

systemctl status disable-yama-ptrace

It should look like this if working correctly:

○ disable-yama-ptrace.service - Disable ptrace access at boot
     Loaded: loaded (/usr/lib/systemd/system/disable-yama-ptrace.service; enabled; preset: disabled)
     Active: inactive (dead) since Sat 2026-05-16 18:05:25 AEST; 1min 18s ago
   Duration: 28ms
 Invocation: 0821fc4ab85c42449443c8de6dfc4641
    Process: 794 ExecStart=/usr/bin/disable-yama-ptrace (code=exited, status=0/SUCCESS)
   Main PID: 794 (code=exited, status=0/SUCCESS)
   Mem peak: 2.5M
        CPU: 6ms

May 16 18:05:25 scott-ser systemd[1]: Started Disable ptrace access at boot.
May 16 18:05:25 scott-ser systemd[1]: disable-yama-ptrace.service: Deactivated successfully.

---

Once the issue has been mitigated in the kernel, you can disable the service:

systemctl disable disable-yama-ptrace

You can also remove the disabled service file if you no longer want it on your system:

sudo rm /usr/lib/systemd/system/disable-yama-ptrace.service

And also remove the executable file:

sudo rm /usr/bin/disable-yama-ptrace