Re: [kernel-hardening] [RFC 2/5 v3] procfs: add hidepid= and gid= mount options

Solar Designer
2011-06-15T14:22:44Z

Vasiliy,

On Wed, Jun 15, 2011 at 05:58:05PM +0400, Vasiliy Kulikov wrote:
> + if (pid->hide_pid &&
> + !ptrace_may_access(task, PTRACE_MODE_READ) &&
> + !in_group_p(pid->pid_gid)) {

I think ptrace_may_access() involves capable() in some cases (when
access would otherwise be denied). Thus, in order not to raise the used
privs flag unnecessarily, you need to check it last - after checking
in_group_p().

Thanks,

Alexander