Linux 6.11 To Allow Tightening Of /proc/[PID]/mem Access For Better Security

Linux 6.11 will introduce a new security feature that allows for the tightening of access to the /proc/[pid]/mem files of processes. This update, proposed by Linux engineer Christian Brauner at Microsoft, aims to restrict writes to the mem file unless the current process ptraces to the given task. The new SECURITY_PROC_MEM_RESTRICT_WRITES Kconfig option will provide finer control over access to /proc//mem, addressing past exploits that abused this feature. By setting specific kernel command line options, users can now restrict access for all processes or allow access only to ptracers. While Brauner acknowledges the complexity of this fine-grained management, he emphasizes the necessity of balancing security with the legitimate use cases that require /proc//mem access, such as debugging tools like gdb and the seccomp notifier. This security enhancement is pending Linus Torvalds' approval for inclusion in the upcoming Linux 6.11 release.