I'd think it's fair to say that at least, a parent with the same UID as the
child
should be able to track the child. I assume that in this case, it is.
-Luke
On Wed, May 11, 2016 at 10:47 PM, Ted Unangst wrote:
> Luke Small wrote:
> > The other kevent calls I use seem to work alright, but when
Luke Small wrote:
> The other kevent calls I use seem to work alright, but when run as root,
> this fails.
contrary to the manual, kevent() enforces additional restrictions on watching
procs. this is a local change that was made when kqueue was first imported,
but i can't think of a reason why.
The other kevent calls I use seem to work alright, but when run as root,
this fails.
#include
#include
#include
#include
#include
#include
#include
#include
#include
int
main()
{
pid_t pid;
int kq;
struct kevent ke;
printf("\nUID: %u\n", getuid());
setuid(1000);