proc_rwmem check PRIV_PROC_MEM_WRITE when writing

[sjg]

Summary

This will fail when mac_veriexec is enforced.

Move the check from procfs_doprocmem to proc_rwmem to ensure all
cases are covered.

Sponsored by: Juniper Networks, Inc.

[olce]

proc_rwmem() is also called by ptrace() and cuse(4). I can imagine you also want to prevent process tampering via ptrace(), but what about cuse(4), and more generally other potential uses where data transfers are performed by proc_rwmem()?

If this is a concern, an alternative would be to add a check of PRIV_PROC_MEM_WRITE directly in kern_ptrace().

sys/sys/priv.h

518