As a user, I can run ls proc and read the /proc directory of the hosting server and read most of the data inside it (~90%).

> ls /proc
1 acpi cpuinfo execdomains ioports kmsg mdstat net scsi sys uptime
21 buddyinfo crypto fb irq kpagecgroup meminfo pagetypeinfo self sysrq-trigger version
23 bus devices filesystems kallsyms kpagecount misc partitions slabinfo sysvipc version_signature
231 cgroups diskstats fs kcore kpageflags modules pressure softirqs thread-self vmallocinfo
232 cmdline dma interrupts keys loadavg mounts sched_debug stat timer_list vmstat
57 consoles driver iomem key-users locks mtrr schedstat swaps tty zoneinfo

Should I report it to the website owner or is it useless information about server hardware?


/proc is used to interact with the kernel and is required by a lot of tooling.

It is considered safe to access, the more sensitive data (eg: /proc/[pid]/* showing per-process information) having stricter permissions.

It is possible to further restrict permissions on /prod/[pid] directories using the hidepid=n mount-time option. (see man page for details).

You can ask the provider to tweak this option to the strictest setting, but I would not call it a security breach.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.