Not to tell about
that /proc/<PID>/fd/ contains only symbolic links, not files, so I can't
understand, how the original reporter managed to gain access to the file in the
restricted directory using that symlink.
The perms are definitely broken and without a code audit on procfs I
would not bet that this is limited just to this rather obscure test
To be honest, I hope that it is limited to this rather obscure test
case. If it is not there may be entertaining ramifications.