Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1559965

Re: [kernel-hardening] [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

> This should permit Linux distributions to more comprehensively lock
> down
> their services, as it allows an isolated opt-in for hidepid= for
> specific services. Previously hidepid= could only be set system-wide,
> and then specific services had to be excluded by group membership,
> essentially a more complex concept of opt-out.

I think it's a lot easier for them to introduce a proc group and then
figure out the very few exceptions that are needed vs. requiring a huge
number of opt-ins. I don't think the issue is difficulty in deploying
it, it's lack of interest. Android deployed it in 7.x without any major
issues. A good way to get people to use it would be adding proc groups
to major distributions and getting systemd to expose a simple toggle for
this, instead of requiring users to add /proc to fstab (not there by
default with systemd) and hard-wired the correct proc gid for that
distribution. Can then file bugs for packages needing the proc group.
For systemd itself, logind needs it since it drops the capability that
allows bypassing it. Other than that, it's mostly just polkit.

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v4 2/2] procfs/tasks: add a simple per-task procfs hidepid= field Djalal Harouni <tixxdz@gmail.com> - 2017-01-16 14:30 +0100
  Re: [kernel-hardening] [PATCH v4 2/2] procfs/tasks: add a simple  per-task procfs hidepid= field Daniel Micay <danielmicay@gmail.com> - 2017-01-16 19:30 +0100
    Re: [kernel-hardening] [PATCH v4 2/2] procfs/tasks: add a simple  per-task procfs hidepid= field Lafcadio Wluiki <wluikil@gmail.com> - 2017-01-17 11:00 +0100
  Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Djalal Harouni <tixxdz@gmail.com> - 2017-01-19 00:00 +0100
    Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Andy Lutomirski <luto@amacapital.net> - 2017-01-19 00:40 +0100
      Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Djalal Harouni <tixxdz@gmail.com> - 2017-01-19 15:00 +0100
        Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Andy Lutomirski <luto@amacapital.net> - 2017-01-19 21:00 +0100
          Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Lafcadio Wluiki <wluikil@gmail.com> - 2017-01-20 17:00 +0100
          Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Djalal Harouni <tixxdz@gmail.com> - 2017-01-20 17:40 +0100
            Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Andy Lutomirski <luto@amacapital.net> - 2017-01-21 02:00 +0100
              Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Djalal Harouni <tixxdz@gmail.com> - 2017-01-23 12:50 +0100
                Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Andy Lutomirski <luto@amacapital.net> - 2017-01-23 21:10 +0100
                Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Djalal Harouni <tixxdz@gmail.com> - 2017-01-26 14:30 +0100
      Re: [PATCH v4 2/2] procfs/tasks: add a simple per-task procfs  hidepid= field Lafcadio Wluiki <wluikil@gmail.com> - 2017-01-20 16:50 +0100

csiph-web