*      [Note: once P_SUGID gets set in execve(), it stays *	set until the process does another execve(). Hence
*      [Note: once P_SUGID or P_SUGIDEXEC gets set in execve(), *      it stays set until the process does another execve(). Hence
systrace_attach(struct fsystrace *fst, pid_t pid){	int error = 0;	struct proc *proc, *p = curproc;	if ((proc = pfind(pid)) == NULL) {		error = ESRCH;		goto out;	}	if (ISSET(proc->p_flag, P_INEXEC)) {		error = EAGAIN;		goto out;	}	/*	 * You can't attach to a process if:	 *	(1) it's the process that's doing the attaching,	 */	if (proc->p_pid == p->p_pid) {		error = EINVAL;		goto out;	}	/*	 *	(2) it's a system process	 */	if (ISSET(proc->p_flag, P_SYSTEM)) {		error = EPERM;		goto out;	}	/*	 *	(3) it's being traced already	 */	if (ISSET(proc->p_flag, P_SYSTRACE)) {		error = EBUSY;		goto out;	}	/*	 *	(4) it's not owned by you, or the last exec	 *	    gave us setuid/setgid privs (unless	 *	    you're root), or...	 *	 *      [Note: once P_SUGID gets set in execve(), it stays	 *	set until the process does another execve(). Hence	 *	this prevents a setuid process which revokes its	 *	special privileges using setuid() from being	 *	traced. This is good security.]	 */	if ((proc->p_cred->p_ruid != p->p_cred->p_ruid ||		ISSET(proc->p_flag, P_SUGID)) &&	    (error = suser(p, 0)) != 0)		goto out;	/*	 *	(5) ...it's init, which controls the security level	 *	    of the entire system, and the system was not	 *          compiled with permanently insecure mode turned	 *	    on.	 */	if ((proc->p_pid == 1) && (securelevel > -1)) {		error = EPERM;		goto out;	}	error = systrace_insert_process(fst, proc); out:	return (error);}