tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

docs,procfs: document /proc/PID/* access permission checks

Add a paragraph explaining what sort of capabilities a process would need
to read procfs data for some other process. Also mention that reading
data for its own process doesn't require any extra permissions.

Link: https://lkml.kernel.org/r/20250129001747.759990-1-andrii@kernel.org
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: "Mike Rapoport (IBM)" <rppt@kernel.org>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

Andrii Nakryiko and committed by
Andrew Morton 87ad827a 541da9f8

+10
+10
Documentation/filesystems/proc.rst
··· 128 128 The link 'self' points to the process reading the file system. Each process 129 129 subdirectory has the entries listed in Table 1-1. 130 130 131 + A process can read its own information from /proc/PID/* with no extra 132 + permissions. When reading /proc/PID/* information for other processes, reading 133 + process is required to have either CAP_SYS_PTRACE capability with 134 + PTRACE_MODE_READ access permissions, or, alternatively, CAP_PERFMON 135 + capability. This applies to all read-only information like `maps`, `environ`, 136 + `pagemap`, etc. The only exception is `mem` file due to its read-write nature, 137 + which requires CAP_SYS_PTRACE capabilities with more elevated 138 + PTRACE_MODE_ATTACH permissions; CAP_PERFMON capability does not grant access 139 + to /proc/PID/mem for other processes. 140 + 131 141 Note that an open file descriptor to /proc/<pid> or to any of its 132 142 contained files or subdirectories does not prevent <pid> being reused 133 143 for some other process in the event that <pid> exits. Operations on