Re: [kernel-hardening] [RFC 2/5 v3] procfs: add hidepid= and gid= mount options

Vasiliy Kulikov
2011-06-15T16:51:40Z

Solar,

On Wed, Jun 15, 2011 at 18:22 +0400, Solar Designer wrote:
> On Wed, Jun 15, 2011 at 05:58:05PM +0400, Vasiliy Kulikov wrote:
> > + if (pid->hide_pid &&
> > + !ptrace_may_access(task, PTRACE_MODE_READ) &&
> > + !in_group_p(pid->pid_gid)) {
>
> I think ptrace_may_access() involves capable() in some cases (when
> access would otherwise be denied). Thus, in order not to raise the used
> privs flag unnecessarily, you need to check it last - after checking
> in_group_p().

Yep, fixed here and in one more place, thanks.

--
Vasiliy