Fix PR_SET_PTRACER applicability to non-leader threads.

Compare

	if (!thread_group_leader(tracee))
		tracee = rcu_dereference(tracee->group_leader);

in security/yama/yama_lsm.c:ptracer_exception_found().

PiperOrigin-RevId: 381074242

pkg/sentry/kernel/ptrace.go

@@ -294,7 +294,7 @@ func (t *Task) isYAMADescendantOfLocked(ancestor *Task) bool {
 
 // Precondition: the TaskSet mutex must be locked (for reading or writing).
 func (t *Task) hasYAMAExceptionForLocked(tracer *Task) bool {
-	allowed, ok := t.k.ptraceExceptions[t]
+	allowed, ok := t.k.ptraceExceptions[t.tg.leader]
 	if !ok {
 		return false
 	}

test/syscalls/linux/BUILD

@@ -1885,6 +1885,7 @@ cc_binary(
     linkstatic = 1,
     deps = [
         "@com_google_absl//absl/flags:flag",
+        "@com_google_absl//absl/strings",
         "@com_google_absl//absl/time",
         gtest,
         "//test/util:capability_util",

test/util/posix_error.h

@@ -385,7 +385,7 @@ class PosixErrorIsMatcher {
 };
 
 // Returns a gMock matcher that matches a PosixError or PosixErrorOr<> whose
-// whose error code matches code_matcher, and whose error message matches
+// error code matches code_matcher, and whose error message matches
 // message_matcher.
 template <typename ErrorCodeMatcher>
 PosixErrorIsMatcher PosixErrorIs(
@@ -395,6 +395,14 @@ PosixErrorIsMatcher PosixErrorIs(
                              std::move(message_matcher));
 }
 
+// Returns a gMock matcher that matches a PosixError or PosixErrorOr<> whose
+// error code matches code_matcher.
+template <typename ErrorCodeMatcher>
+PosixErrorIsMatcher PosixErrorIs(ErrorCodeMatcher&& code_matcher) {
+  return PosixErrorIsMatcher(std::forward<ErrorCodeMatcher>(code_matcher),
+                             ::testing::_);
+}
+
 // Returns a gMock matcher that matches a PosixErrorOr<> which is ok() and
 // value matches the inner matcher.
 template <typename InnerMatcher>