Re: [kernel-hardening] [RFC 2/5 v3] procfs: add hidepid= and gid= mount options

[Vasiliy Kulikov <segoon@openwall.com>]

Solar,

On Wed, Jun 15, 2011 at 18:22 +0400, Solar Designer wrote:
> On Wed, Jun 15, 2011 at 05:58:05PM +0400, Vasiliy Kulikov wrote:
> > +	if (pid->hide_pid &&
> > +	    !ptrace_may_access(task, PTRACE_MODE_READ) &&
> > +	    !in_group_p(pid->pid_gid)) {
> 
> I think ptrace_may_access() involves capable() in some cases (when
> access would otherwise be denied).  Thus, in order not to raise the used
> privs flag unnecessarily, you need to check it last - after checking
> in_group_p().

Yep, fixed here and in one more place, thanks.

-- 
Vasiliy