Linux kernel 4.14 patch to disguise TracerPid in /proc/*/status

gistfile1.txt

commit acc0182c3d3869802bc20c8bf4e04c3464936bcc
Author: Douglas Hellinger <doug.hellinger@hotmail.com>
Date:   Sun Nov 19 22:48:46 2017 +0800

    Fix tracerPid=0 in /proc

diff --git a/fs/proc/array.c b/fs/proc/array.c
index 6f6fc16..bcf470d 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -171,7 +171,8 @@ static inline void task_state(struct seq_file *m, struct pid_namespace *ns,
 
        tracer = ptrace_parent(p);
        if (tracer)
-               tpid = task_pid_nr_ns(tracer, ns);
+         // hide TracerPid
+               tpid = 0;
 
        tgid = task_tgid_nr_ns(p, ns);
        ngid = task_numa_group_id(p);

Be nice if you could get this accepted upstream with a kernel flag. Microsoft is using this in a futile attempt to lock down their products https://unix.stackexchange.com/q/413697/3285