"Others" cannot read 'smaps_rollup' file with -r--r--r-- permission under /proc/PID/. Why?

Question

I'm trying to read two specific files, namely status and smaps_rollup for all the processes under /proc. All process directories have dr-xr-xr-x permission and I'm able to enter every one of these directories.

For all the processes the permissions for both of these files are -r--r--r--.

Here's the bizarre behavior. Let's say I try to read both the files for PID 1. I can read status file, but not smaps_rollup. See below:

$ cd /proc/1

$ ls -l status smaps_rollup
-r--r--r-- 1 root root 0 Apr  5 18:34 smaps_rollup
-r--r--r-- 1 root root 0 Mar 21 12:18 status

$ grep "Swap:" status
VmSwap:     1072 kB

$ grep "Swap:" smaps_rollup
grep: smaps_rollup: Permission denied

$ cat smaps_rollup
cat: smaps_rollup: Permission denied

I looked for related questions and came across some of them^[1][2][3][4]. None of them has the same problem. The solutions to these other problems had to do with fixing the missing executable permission on the directory. That's not the case here.

Here is mount info for proc:

proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)

I'm running Arch Linux with kernel 6.2.7-arch1-1 provided by Arch Linux.

I'm looking for a correct explanation of this bizarre behavior. And is there something I can do to fix this problem, besides using sudo as a workaround?

---

1. Can't read file even though permissions are correct

2. Why I can't read file?

3. File read permissions for 'others' not working

4. How can I check read permission of /proc// files?

Answer 1

This doesn’t appear to be explicitly documented; it’s documented transitively in man 5 proc, through the documentation for /proc/[pid]/maps:

Permission to access this file is governed by a ptrace access mode PTRACE_MODE_READ_FSCREDS check; see ptrace(2).

The smaps documentation says

The first of these lines shows the same information as is displayed for the mapping in /proc/[pid]/maps.

Since the latter is sensitive, it is protected in a similar fashion. smaps_rollup is less sensitive and could be opened up but the latter patch hasn’t got anywhere as far as I can tell.

It should be possible to use capabilities to work around this, but I haven’t tried.

Many files, directories and links in /proc aren’t necessarily as accessible as indicated by their permissions; in particular, many files require the same privileges as maps and smaps, PTRACE_MODE_READ_FSCREDS. These requirements are detailed in man 5 proc. This means that the visible permissions should only be considered an upper bound on permissions; in particular, they are useful to determine whether a /proc entry is intended for updating kernel settings (it’s writable) rather than only viewing them.