0

I am trying to make a restriction to procfs like only a certain groups of members can perform read and write actions.

kernel document says we can do that by setting hidepid and gid in /etc/fstab. It will restrict the malicious user from making read and write on procfs but I have a doubt whether it is possible for malicious user (restricted in the /etc/fstab) to access content in profs using syscall instead of fs operation like read and write.

Improve this question
7
  • 1
    What end specifically are you trying to prevent malicious users from doing? Accessing /proc isn't the end; it's the means to the end.
    – Joseph Sible-Reinstate Monica
    Commented Mar 14, 2020 at 15:36
  • @JosephSible-ReinstateMonica there is multiple end. for example you can take malicious user should not read other users cmdline value which will be in /proc/<id>/cmdline or you can also take malicious user should not read other users environ value which will be in /proc/<id>/environ.
    – Karthik Nedunchezhiyan
    Commented Mar 14, 2020 at 15:42
  • Why do you think hidepid=2 isn't good enough to stop that?
    – Joseph Sible-Reinstate Monica
    Commented Mar 14, 2020 at 15:45
  • Yes while reading it sounds good, but I need to double-check is this option is sufficient. Is there any other way a malicious user can view the environment value (environ) of other users using syscall or any other way?
    – Karthik Nedunchezhiyan
    Commented Mar 14, 2020 at 15:47
  • Why do you think hidepid isn't effective against syscalls, when they're the normal way to read from there?
    – Joseph Sible-Reinstate Monica
    Commented Mar 14, 2020 at 15:52

1 Answer 1

Reset to default
1

In general, hidepid mentioned in the comments is the best way.

If you need more security than that, use a mandatory access control system like SELinux or AppArmor, and possibly systrace. These tools let you restrict file system access, syscalls and more. I think most of the info in /proc is not available from syscalls, but I'm not up-to-date on this.

MAC tools are not "click and go" solutions and require quite a lot of work to configure. Before you embark on this, have a think about whether this is the best way to invest your security resources.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .