runsc: grant CAP_SYS_PTRACE to the sandbox process when it is required

PiperOrigin-RevId: 683687479

g3doc/user_guide/FAQ.md

@@ -83,19 +83,6 @@ Make sure that permissions is correct on the `runsc` binary.
 sudo chmod a+rx /usr/local/bin/runsc
 ```
 
-If your Kernel is configured with YAMA LSM (see
-https://www.kernel.org/doc/Documentation/security/Yama.txt and
-https://man7.org/linux/man-pages/man2/ptrace.2.html) gVisor may fail in certain
-modes (i.e., systrap and/or directfs) with this error if
-`/proc/sys/kernel/yama/ptrace_scope` is set to 2. If this is the case, try
-setting `/proc/sys/kernel/yama/ptrace_scope` to max of mode 1:
-
-```bash
-sudo cat /proc/sys/kernel/yama/ptrace_scope
-2
-sudo bash -c 'echo 1 > /proc/sys/kernel/yama/ptrace_scope'
-```
-
 ### I'm getting an error like `mount submount "/etc/hostname": creating mount with source ".../hostname": input/output error: unknown.` {#memlock}
 
 There is a bug in Linux kernel versions 5.1 to 5.3.15, 5.4.2, and 5.5. Upgrade

runsc/hostsettings/hostsettings.go

@@ -212,24 +212,6 @@ func check(conf *config.Config) ([]*Delta, []error) {
 				return strconv.Itoa(recommendedMaxMapCount), false, nil
 			},
 		},
-		{
-			path:          "/proc/sys/kernel/yama/ptrace_scope",
-			mightNotExist: true,
-			purpose:       "ptrace_scope=1 enables the systrap and ptrace platforms to work, as well as --directfs=false",
-			delta: func(conf *config.Config, current string) (string, bool, error) {
-				// systrap and ptrace require this because they use ptrace.
-				// DirectFS=false requires this as well: https://github.com/google/gvisor/issues/9006
-				if conf.Platform != "systrap" && conf.Platform != "ptrace" && conf.DirectFS {
-					// Setting not required.
-					return "", false, nil
-				}
-				current = strings.TrimSpace(current)
-				if current == "0" || current == "1" {
-					return "", false, nil
-				}
-				return "1", true, nil
-			},
-		},
 		{
 			path:    "/proc/sys/user/max_user_namespaces",
 			purpose: "runsc requires creating at least 2 new user namespaces and may run into the limit when creating multiple containers",

runsc/sandbox/sandbox.go

@@ -1077,7 +1077,10 @@ func (s *Sandbox) createSandboxProcess(conf *config.Config, args *Args, startSyn
 				// CAP_SETPCAP is required to clear the bounding set.
 				uintptr(capability.CAP_SETPCAP),
 			)
-
+			if gPlatform.Requirements().RequiresCapSysPtrace {
+				cmd.SysProcAttr.AmbientCaps = append(cmd.SysProcAttr.AmbientCaps,
+					uintptr(capability.CAP_SYS_PTRACE))
+			}
 		} else {
 			return fmt.Errorf("can't run sandbox process as user nobody since we don't have CAP_SETUID or CAP_SETGID")
 		}