On CentOS 7, I am trying to debug an issue where the nginx amplify agent cannot read /proc/$pid/io even though it is owned by the proper user.
One of the nginx worker processes right now is pid 5693:
# ps aux | grep 5693
nginx 5693 0.5 0.0 129000 14120 ? S Jul18 16:10 nginx: worker process
the nginx user has permission to read the file:
# ls -lAh /proc/5693/io
-r-------- 1 nginx nginx 0 Jul 20 11:30 /proc/5693/io
...but can't actually read it:
# sudo -u nginx /bin/sh -c 'cat /proc/5693/io'
cat: /proc/5693/io: Permission denied
...even though selinux is disabled:
# sestatus
SELinux status: disabled
Root is able to read /proc/5693/io just fine, and the nginx user can read other files in /proc/5693. It seems like there must be some other security mechanism in place that is preventing the access, but I have no idea what it might be.
proc(5)
has to say on/proc/[pid]/io
, "Permission to access this file is governed by a ptrace access mode TRACE_MODE_READ_FSCREDS check; see ptrace(2)." The Ptrace access mode checking section of theptrace(2)
man page contains a list of things that are checked to grant or deny permission, including wether the process is marked dumpable, wether you have the same fsuid as the target process etc, might be worth it having a look at it.