The higher ptrace restriction levels should be blocking even PTRACE_TRACEME requests. The comments in the LSM documentation are misleading about when the checks happen (the parent does not go through security_ptrace_access_check() on a PTRACE_TRACEME call). Signed-off-by: Kees Cook <keescook@chromium.org> Cc: stable@vger.kernel.org # 3.5.x and later Signed-off-by: James Morris <james.l.morris@oracle.com> (cherry picked from 9d8dad742ad1c74d7e7210ee05d0b44961d5ea16) Signed-off-by: Tyler Hicks <tyhicks@canonical.com> Signed-off-by: Andy Whitcroft <apw@canonical.com>