Messages in this thread | | | Date | Sat, 7 Sep 2013 01:51:16 -0700 (PDT) | From | Christian Kujau <> | Subject | proc hidepid=2 and SGID programs |
| |
Hi,
I was wondering why I cannot see processes that were started from SGID programs:
================================ $ grep ^proc /proc/mounts proc /proc proc rw,nosuid,nodev,noexec,relatime,hidepid=2 0 0
$ ls -n `which ssh-agent` -rwxr-sr-x 1 0 103 132748 Feb 8 2013 /usr/bin/ssh-agent
$ eval `ssh-agent` Agent pid 3177
$ ps -o euid,ruid,suid,egid,rgid,sgid,pid,comm -p 3177 EUID RUID SUID EGID RGID SGID PID COMMAND
$ sudo ps -o euid,ruid,suid,egid,rgid,sgid,pid,comm -p 3177 EUID RUID SUID EGID RGID SGID PID COMMAND 1000 1000 1000 1000 1000 103 3177 ssh-agent ================================
Although the binary has the SGID bit set, the process seems to belong to myself (uid/gid 1000), as it probably dropped ssh-group permissions after start. But the PID is not visible in /proc and I cannot "find" it:
================================ $ pgrep ssh-agent; echo $? 1
$ pkill ssh-agent; echo $? 1
$ kill 3177; echo $? 0 ================================
Because I knew the PID, I could terminate it of course. Is this expected behaviour? Shouldn't my own processes be visible to myself, even with /proc mounted with the hidepid=2 option?
Christian. -- BOFH excuse #412:
Radial Telemetry Infiltration
| |