#!/bin/sh
# DF-2706 run (see VERDICT.md for preconditions)
cd "$(dirname "$0")"
as root: cp /bin/sleep /tmp/snoopmark && chmod 700 /tmp/snoopmark && nohup /tmp/snoopmark 600 & ; sysctl security.ps_showallprocs=0 ; then as unpriv user: /tmp/pidsnoop <rootpid> ; /tmp/pidsnoop -all ; /tmp/pidsnoop -uid 0