4

There is a process which is running under root user. 

ps aux | grep ProcessX root 11565 0.0 0.7 82120 22976 ? Ssl 14:57 0:02 ProcessX

Now ls -l /proc/11565/ (pid ) gives this result. 

total 0 dr-xr-xr-x 2 root root 0 Aug 9 16:06 attr -rw-r--r-- 1 root root 0 Aug 9 16:06 autogroup -r-------- 1 root root 0 Aug 9 16:06 auxv -r--r--r-- 1 root root 0 Aug 9 16:06 cgroup --w------- 1 root root 0 Aug 9 16:06 clear_refs -r--r--r-- 1 root root 0 Aug 9 16:06 cmdline -rw-r--r-- 1 root root 0 Aug 9 16:06 coredump_filter -r--r--r-- 1 root root 0 Aug 9 16:06 cpuset lrwxrwxrwx 1 root root 0 Aug 9 16:06 cwd -> /usr/local/bin -r-------- 1 root root 0 Aug 9 16:06 environ lrwxrwxrwx 1 root root 0 Aug 9 16:06 exe -> /usr/local/bin/ProcessX dr-x------ 2 root root 0 Aug 9 16:06 fd dr-x------ 2 root root 0 Aug 9 16:06 fdinfo -r-------- 1 root root 0 Aug 9 16:06 io -rw------- 1 root root 0 Aug 9 16:06 limits -rw-r--r-- 1 root root 0 Aug 9 16:06 loginuid -r--r--r-- 1 root root 0 Aug 9 16:06 maps -rw------- 1 root root 0 Aug 9 16:06 mem -r--r--r-- 1 root root 0 Aug 9 16:06 mountinfo -r--r--r-- 1 root root 0 Aug 9 16:06 mounts -r-------- 1 root root 0 Aug 9 16:06 mountstats dr-xr-xr-x 6 root root 0 Aug 9 16:06 net -r--r--r-- 1 root root 0 Aug 9 16:06 numa_maps -rw-r--r-- 1 root root 0 Aug 9 16:06 oom_adj -r--r--r-- 1 root root 0 Aug 9 16:06 oom_score -rw-r--r-- 1 root root 0 Aug 9 16:06 oom_score_adj -r--r--r-- 1 root root 0 Aug 9 16:06 pagemap -r--r--r-- 1 root root 0 Aug 9 16:06 personality lrwxrwxrwx 1 root root 0 Aug 9 16:06 root -> / -rw-r--r-- 1 root root 0 Aug 9 16:06 sched -r--r--r-- 1 root root 0 Aug 9 16:06 schedstat -r--r--r-- 1 root root 0 Aug 9 16:06 sessionid -r--r--r-- 1 root root 0 Aug 9 16:06 smaps -r--r--r-- 1 root root 0 Aug 9 16:06 stack -r--r--r-- 1 root root 0 Aug 9 16:06 stat -r--r--r-- 1 root root 0 Aug 9 16:06 statm -r--r--r-- 1 root root 0 Aug 9 16:06 status -r--r--r-- 1 root root 0 Aug 9 16:06 syscall dr-xr-xr-x 6 root root 0 Aug 9 16:06 task -r--r--r-- 1 root root 0 Aug 9 16:06 wchan

Now the file permission for both status and maps are same (-r--r--r--). But when I issue cat /proc/11565/maps with a non privileged (not root) user, it gives me a permission denied. But for cat /proc/11565/status, it outputs as expected.

Is there something I am missing here?

Improve this question

2 Answers 2

Reset to default
8

It's because the file permissions are not the only protection you're encountering.

Those aren't just regular text files on a file system, procfs is a window into process internals and you have to get past both the file permissions plus whatever other protections are in place.

The maps show potentially dangerous information about memory usage and where executable code is located within the process space. If you look into ASLR, you'll see this was a method of preventing potential attackers from knowing where code was loaded and it wouldn't make sense to reveal it in a world-readable entry in procfs.

This protection was added way back in 2007:

This change implements a check using "ptrace_may_attach" before allowing access to read the maps contents. To control this protection, the new knob /proc/sys/kernel/maps_protect has been added, with corresponding updates to the procfs documentation.

Within ptrace_may_attach() (actually within one of the functions it calls) lies the following code:

if (((current->uid != task->euid) || (current->uid != task->suid) || (current->uid != task->uid) || (current->gid != task->egid) || (current->gid != task->sgid) || (current->gid != task->gid)) && !capable(CAP_SYS_PTRACE)) return -EPERM;

so that, unless you have the same real user/group ID, saved user/group ID and effective user/group ID (i.e., no sneaky setuid stuff) and they're the same as the user/group ID that owns the process, you're not allowed to see inside that "file" (unless your process has the CAP_SYS_PTRACE capability of course).

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

0

The process uid must match the smaps uid, and the process gid must match the smaps gid.

$ ls -l /proc/15889/smaps /proc/16139/smaps -r--r--r--. 1 oracle dba 0 Feb 10 16:42 /proc/15889/smaps -r--r--r--. 1 oracle asmadmin 0 Feb 10 16:42 /proc/16139/smaps $ wc /proc/15889/smaps /proc/16139/smaps 6851 23498 224275 /proc/15889/smaps wc: /proc/16139/smaps: Permission denied 6851 23498 224275 total $ id uid=400(oracle) gid=400(dba) groups=400(dba),522(asmadmin),etc.

Same for environ, io, and all memory maps.

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.