Comment on: `kernel.yama.ptrace_scope = 2` looks like a promising way to mitigate

>apparently it does not block all cases https://www.openwall.com/lists/oss-security/2026/05/15/5 The [reply to that post from Qualsys](https://www.openwall.com/lists/oss-security/2026/05/15/8) indicates that it actually does block all known cases, and it's likely to block all of them. The reason is this note in the [pidfd_getfd man page](https://man7.org/linux/man-pages/man2/pidfd_getfd.2.html): >The ability to use pidfd_getfd() is restricted by a PTRACE_MODE_ATTACH_REALCREDS ptrace access mode check. Setting `/proc/sys/kernel/yama/ptrace_scope` to `2` removes that ability. From the [ptrace man page](https://man.archlinux.org/man/ptrace.2.en), setting it to `2` means: >Only processes with the CAP_SYS_PTRACE capability in the user namespace of the target process may perform PTRACE_MODE_ATTACH operations That said, the comment after that is probably relevant: >With respect to values 1 and 2, note that creating a new user namespace effectively removes the protection offered by Yama....