Re: Why can't I ptrace init (pid == 1) ?

[Mike Coleman]

[e-mail] (Miquel van Smoorenburg) writes:
> The reason right now is I think that ptrace mucks around with sibling
> relations and since init is a special 'father of all processes' (or is that
> mother?) that would get the system into trouble real soon.

Yes.  Ptrace does a sort of fakey reparenting of traced processes, which won't
work correctly with init, since it's its own parent.

Notice that init *is* currently allowed to do a PTRACE_TRACEME, which would
almost certainly cause the system to fail spectacularly.  It's not really a
security problem, since init can do anything anyway, but it does annoy my
aesthetic sensibilities a bit.  (The patch I sent to fix this wasn't
incorporated.)

-- 
Mike Coleman, [e-mail]
http://www.mathdogs.com
problem solving, expert software development