Find in-memory modification of kernel.yama.ptrace_scope with bpftrace - PoC

gistfile1.txt

#!/usr/bin/env bpftrace

BEGIN
{
    // Replace with the actual address from /proc/kallsyms
    $data_addr = 0xffffffff83c983b0;  // Example: yama_sysctl_table->data address
    @last_val = *(int32*)$data_addr;  // Initial value
    printf("Monitoring kernel.yama.ptrace_scope at address 0x%x (initial value: %d)\n",
           $data_addr, @last_val);
}

interval:s:1
{
    $data_addr = 0xffffffff83c983b0;  // Same address
    $current = *(int32*)$data_addr;
    if (@last_val != $current) {
        time("%H:%M:%S ");
        printf("ALERT: kernel.yama.ptrace_scope changed from %d to %d!\n",
               @last_val, $current);
        @last_val = $current;
    }
}

END
{
    clear(@last_val);
    printf("Monitoring stopped\n");
}

Awesome! Thanks - it works great :)