ptrace.2: Describe PTRACE_MODE_NOAUDIT in more detail

Signed-off-by: Michael Kerrisk <mtk.manpages@gmail.com>
This commit is contained in:
Stephen Smalley 2016-06-24 10:27:53 +02:00 committed by Michael Kerrisk
parent 78f0786577
commit 3cd161fe57
1 changed files with 9 additions and 0 deletions

View File

@ -2168,6 +2168,15 @@ One further modifier can be ORed with the access mode:
.\" commit 69f594a38967f4540ce7a29b3fd214e68a8330bd
.\" Just for /proc/pid/stat
Don't audit this access mode check.
This modifier is employed for ptrace access mode checks
(such as checks when reading
.IR /proc/[pid]/stat )
that merely cause the output to be filtered or sanitized,
rather than causing an error to be returned to the caller.
In these cases, accessing the file is not a security violation and
there is no reason to generate a security audit record.
This modifier suppresses the generation of
such an audit record for the particular access check.
.PP
The algorithm employed for ptrace access mode checking determines whether
the calling process is allowed to perform the corresponding action