linux-kernel - proc hidepid=2 and SGID programs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.11.1309070133340.21301@trent.utfs.org>
Date:	Sat, 7 Sep 2013 01:51:16 -0700 (PDT)
From:	Christian Kujau <lists@...dbynature.de>
To:	LKML <linux-kernel@...r.kernel.org>
cc:	Vasiliy Kulikov <segoon@...nwall.com>
Subject: proc hidepid=2 and SGID programs

Hi,

I was wondering why I cannot see processes that were started from SGID 
programs:

================================
$ grep ^proc /proc/mounts
proc /proc proc rw,nosuid,nodev,noexec,relatime,hidepid=2 0 0

$ ls -n `which ssh-agent`
-rwxr-sr-x 1 0 103 132748 Feb  8  2013 /usr/bin/ssh-agent

$ eval `ssh-agent`
Agent pid 3177

$ ps -o euid,ruid,suid,egid,rgid,sgid,pid,comm -p 3177
 EUID  RUID  SUID  EGID  RGID  SGID   PID COMMAND

$ sudo ps -o euid,ruid,suid,egid,rgid,sgid,pid,comm -p 3177
 EUID  RUID  SUID  EGID  RGID  SGID   PID COMMAND
 1000  1000  1000  1000  1000   103  3177 ssh-agent
================================

Although the binary has the SGID bit set, the process seems to belong to 
myself (uid/gid 1000), as it probably dropped ssh-group permissions after 
start. But the PID is not visible in /proc and I cannot "find" it:

================================
$ pgrep ssh-agent; echo $?
1

$ pkill ssh-agent; echo $?
1

$ kill 3177; echo $?
0
================================

Because I knew the PID, I could terminate it of course. Is this expected 
behaviour? Shouldn't my own processes be visible to myself, even with 
/proc mounted with the hidepid=2 option?

Christian.
-- 
BOFH excuse #412:

Radial Telemetry Infiltration
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/