Re: [PATCH 2/3] proc: query LSMs for introspective mem access (if PROC_MEM_FORCE_ALWAYS)

On Wed, Aug 26, 2026 at 3:01 PM Christian Brauner <[email protected]> wrote:
> On Wed, Aug 26, 2026 at 12:29:14PM +0200, Christian Brauner wrote:
> > It seems odd to just call a hook when it's introspection denied.
> > And if that's the case why not also have a general hook in
> > ptrace_may_access() itself in the introspection branch?
> >
> > I would actually have use-cases for this btw.
>
> To be clear: I have no quarrels with this going in as is. I'm just
> interested in how policy decision such as this can be made more
> meaningful in general. If you have thoughts around this you want to
> share, please do.

A distinction that might be useful in my opinion would be to
distinguish between read access to memory/registers (like for
collecting information after a crash) and write access to process
state like memory/registers (which would only be needed for actual
debugging or fault injection). However, ptrace() makes it hard to draw
such a clean distinction because resuming a stopped task can inject
signals with arbitrary signal numbers...