lkml.org 
[lkml]   [2013]   [Sep]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subjectproc hidepid=2 and SGID programs
Hi,

I was wondering why I cannot see processes that were started from SGID
programs:

================================
$ grep ^proc /proc/mounts
proc /proc proc rw,nosuid,nodev,noexec,relatime,hidepid=2 0 0

$ ls -n `which ssh-agent`
-rwxr-sr-x 1 0 103 132748 Feb 8 2013 /usr/bin/ssh-agent

$ eval `ssh-agent`
Agent pid 3177

$ ps -o euid,ruid,suid,egid,rgid,sgid,pid,comm -p 3177
EUID RUID SUID EGID RGID SGID PID COMMAND

$ sudo ps -o euid,ruid,suid,egid,rgid,sgid,pid,comm -p 3177
EUID RUID SUID EGID RGID SGID PID COMMAND
1000 1000 1000 1000 1000 103 3177 ssh-agent
================================

Although the binary has the SGID bit set, the process seems to belong to
myself (uid/gid 1000), as it probably dropped ssh-group permissions after
start. But the PID is not visible in /proc and I cannot "find" it:

================================
$ pgrep ssh-agent; echo $?
1

$ pkill ssh-agent; echo $?
1

$ kill 3177; echo $?
0
================================

Because I knew the PID, I could terminate it of course. Is this expected
behaviour? Shouldn't my own processes be visible to myself, even with
/proc mounted with the hidepid=2 option?

Christian.
--
BOFH excuse #412:

Radial Telemetry Infiltration


\
 
 \ /
  Last update: 2013-09-07 11:21    [W:0.074 / U:0.248 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site