The Linux kernels seccomp implementation contained a method to bypass seccomp syscall filtering policies that allowed ptrace. This could allow an attacker with code execution priviledges within the sandbox to use ptrace to execute systemcalls that would be filtered by the policy. The secuirty mechanism that is bypassed is standard 'seccomp' sandboxing, not operating system acls or permissions. References: https://source.android.com/security/bulletin/2019-05-01
At this time Red Hat Product security considers this more system-hardening than a flaw. This behavior is clearly defined in the seccomp man page and there is a chance that systems may rely on that behavior. I will create public-facing "hardening" bugs for Red Hat Enterprise Linux kernels for : 6 (https://bugzilla.redhat.com/show_bug.cgi?id=1715268) : 7 (https://bugzilla.redhat.com/show_bug.cgi?id=1715271) : 7-alt (https://bugzilla.redhat.com/show_bug.cgi?id=1715272 ) : 8 (https://bugzilla.redhat.com/show_bug.cgi?id=1715436 ) Where interest can be voiced by customers/interested parties.