I've noticed that some procs, such as bash, have their entire /proc/<pid>/
resources readable by the user who created that proc. However other procs, such as chrome or gnome-keyring-daemon, have most of their /proc/<pid>/
resources only accessible by root, despite the process itself being owned by the normal user and no suid being called.
I dug through the kernel a bit and found that the /proc/ stuff gets limited if a task lacks a 'dumpable' flag, however I'm having a hard time understanding under what scenarios a task becomes undumpable (other than the setuid case, which doesn't apply to chrome or gnome-keyring):
https://github.com/torvalds/linux/blob/164c09978cebebd8b5fc198e9243777dbaecdfa0/fs/proc/base.c#L1532
Anyone care to help me understand the underlying mechanism and the reasons for it?
Thanks!
Edit:
Found a good doc on why you wouldn't want to have your SSH agent (such as gnome-keyring-daemon
) dumpable by your user. Still not sure how gnome-keyring-daemon
is making itself undumpable.