proc hidepid=2 and SGID programs

[Christian Kujau]

Hi,

I was wondering why I cannot see processes that were started from SGID 
programs:

================================
$ grep ^proc /proc/mounts
proc /proc proc rw,nosuid,nodev,noexec,relatime,hidepid=2 0 0

$ ls -n `which ssh-agent`
-rwxr-sr-x 1 0 103 132748 Feb  8  2013 /usr/bin/ssh-agent

$ eval `ssh-agent`
Agent pid 3177

$ ps -o euid,ruid,suid,egid,rgid,sgid,pid,comm -p 3177
 EUID  RUID  SUID  EGID  RGID  SGID   PID COMMAND

$ sudo ps -o euid,ruid,suid,egid,rgid,sgid,pid,comm -p 3177
 EUID  RUID  SUID  EGID  RGID  SGID   PID COMMAND
 1000  1000  1000  1000  1000   103  3177 ssh-agent
================================

Although the binary has the SGID bit set, the process seems to belong to 
myself (uid/gid 1000), as it probably dropped ssh-group permissions after 
start. But the PID is not visible in /proc and I cannot "find" it:

================================
$ pgrep ssh-agent; echo $?
1

$ pkill ssh-agent; echo $?
1

$ kill 3177; echo $?
0
================================

Because I knew the PID, I could terminate it of course. Is this expected 
behaviour? Shouldn't my own processes be visible to myself, even with 
/proc mounted with the hidepid=2 option?

Christian.
-- 
BOFH excuse #412:

Radial Telemetry Infiltration
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/