Si je comprend bien c'est seulement un parent qui peut modifier ses processus fils, ce qui est beaucoup moins grave que n'importe quel processus du même utilisateur.
Non t'as rien compris : PTRACE_ATTACH
Attaches to the process specified in pid, making it a traced
"child" of the current process; the behavior of the child is as
if it had done a PTRACE_TRACEME. The current process actually
becomes the parent of the child process for most purposes (e.g.,
it will receive notification of child events and appears in
ps(1) output as the child's parent), but a getppid(2) by the
child will still return the pid of the original parent. The
child is sent a SIGSTOP, but will not necessarily have stopped
by the completion of this call; use wait to wait for the child
to stop. (addr and data are ignored.)
[...]
EPERM The specified process cannot be traced. This could be because
the parent has insufficient privileges (the required capability
is CAP_SYS_PTRACE); non-root processes cannot trace processes
that they cannot send signals to or those running setuid/setgid
programs, for obvious reasons. Alternatively, the process may
already be being traced, or be init (pid 1).
[^] # Re: Firestarter
Posté par M . En réponse au journal "j'me sens plus en secu sous win" j'ai pas pu lui repondre. Évalué à 3.
Non t'as rien compris :
PTRACE_ATTACH
Attaches to the process specified in pid, making it a traced
"child" of the current process; the behavior of the child is as
if it had done a PTRACE_TRACEME. The current process actually
becomes the parent of the child process for most purposes (e.g.,
it will receive notification of child events and appears in
ps(1) output as the child's parent), but a getppid(2) by the
child will still return the pid of the original parent. The
child is sent a SIGSTOP, but will not necessarily have stopped
by the completion of this call; use wait to wait for the child
to stop. (addr and data are ignored.)
[...]
EPERM The specified process cannot be traced. This could be because
the parent has insufficient privileges (the required capability
is CAP_SYS_PTRACE); non-root processes cannot trace processes
that they cannot send signals to or those running setuid/setgid
programs, for obvious reasons. Alternatively, the process may
already be being traced, or be init (pid 1).