man/man7/capabilities.7: Expand CAP_SYS_PTRACE to include /proc

CAP_SYS_PTRACE is required (via ptrace_may_access) for accessing various
things in /proc, so include it in the CAP_SYS_PTRACE bullet list.

Also, add a hint that other things throughout the kernel may check this
via ptrace_may_access().

Signed-off-by: Jonathon Reinhart <jrreinhart@google.com>
Message-ID: <20250924152313.1902586-1-jrreinhart@google.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>

diff --git a/man/man7/capabilities.7 b/man/man7/capabilities.7
index f8b389f1ed7516d64e88fb950c06e54860d6c630..54f663d7b6cd218e4c23fba7fe37f9831d57a9c1 100644 (file)
--- a/man/man7/capabilities.7
+++ b/man/man7/capabilities.7
@@ -625,6 +625,15 @@ Use
 Trace arbitrary processes using
 .BR ptrace (2);
 .IP \[bu]
+inspect sensitive information of other processes via
+.I /proc
+(e.g., reading
+.IR /proc/ pid /maps ,
+.IR /proc/ pid /mem ,
+or reading symbolic links
+.IR /proc/ pid /exe ,
+.IR /proc/ pid /fd/* );
+.IP \[bu]
 apply
 .BR get_robust_list (2)
 to arbitrary processes;
@@ -635,7 +644,12 @@ and
 .BR process_vm_writev (2);
 .IP \[bu]
 inspect processes using
-.BR kcmp (2).
+.BR kcmp (2);
+.IP \[bu]
+perform other privileged process-inspection and debugging operations.
+(See uses of the
+.IR ptrace_may_access ()
+kernel function.)
 .RE
 .PD
 .TP