> > "Being traced by the caller" still (maybe?) means the caller is > temporarily the parent of the process under investigation. So if > that's not true, that would falsify b. However, in other cases, you > might be the parent anyhow.
kernel/ptrace.c " * ptrace a task: make the debugger its new parent and * move it to the ptrace list. " --> seems that is the case. however: " * unptrace a task: move it back to its original parent and * remove it from the ptrace list. " So I guess maybe you can check if the pgid of a pid matches the parents ? / the ppid is ptrace mmm. -- Patch griefs with proverbs. -- William Shakespeare, "Much Ado About Nothing" _______________________________________________ coders mailing list coders@slug.org.au http://lists.slug.org.au/listinfo/coders
