I am trying to make a restriction to procfs like only a certain groups of members can perform read and write actions.
kernel document says we can do that by setting
/etc/fstab. It will restrict the malicious user from making read and write on procfs but I have a doubt whether it is possible for malicious user (restricted in the
/etc/fstab) to access content in profs using
syscall instead of
fs operation like read and write.
/proc/<id>/cmdlineor you can also take malicious user should not read other users environ value which will be in
hidepid=2isn't good enough to stop that?
environment value (environ)of other users using syscall or any other way?
hidepidisn't effective against syscalls, when they're the normal way to read from there?