leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
b196be89cd
linux/Documentation
History
Vasiliy Kulikov 0499680a42 procfs: add hidepid= and gid= mount options 
Add support for mount options to restrict access to /proc/PID/
directories.  The default backward-compatible "relaxed" behaviour is left
untouched.

The first mount option is called "hidepid" and its value defines how much
info about processes we want to be available for non-owners:

hidepid=0 (default) means the old behavior - anybody may read all
world-readable /proc/PID/* files.

hidepid=1 means users may not access any /proc/<pid>/ directories, but
their own.  Sensitive files like cmdline, sched*, status are now protected
against other users.  As permission checking done in proc_pid_permission()
and files' permissions are left untouched, programs expecting specific
files' modes are not confused.

hidepid=2 means hidepid=1 plus all /proc/PID/ will be invisible to other
users.  It doesn't mean that it hides whether a process exists (it can be
learned by other means, e.g.  by kill -0 $PID), but it hides process' euid
and egid.  It compicates intruder's task of gathering info about running
processes, whether some daemon runs with elevated privileges, whether
another user runs some sensitive program, whether other users run any
program at all, etc.

gid=XXX defines a group that will be able to gather all processes' info
(as in hidepid=0 mode).  This group should be used instead of putting
nonroot user in sudoers file or something.  However, untrusted users (like
daemons, etc.) which are not supposed to monitor the tasks in the whole
system should not be added to the group.

hidepid=1 or higher is designed to restrict access to procfs files, which
might reveal some sensitive private information like precise keystrokes
timings:

http://www.openwall.com/lists/oss-security/2011/11/05/3

hidepid=1/2 doesn't break monitoring userspace tools.  ps, top, pgrep, and
conky gracefully handle EPERM/ENOENT and behave as if the current user is
the only user running processes.  pstree shows the process subtree which
contains "pstree" process.

Note: the patch doesn't deal with setuid/setgid issues of keeping
preopened descriptors of procfs files (like
https://lkml.org/lkml/2011/2/7/368).  We rely on that the leaked
information like the scheduling counters of setuid apps doesn't threaten
anybody's privacy - only the user started the setuid program may read the
counters.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Randy Dunlap <rdunlap@xenotime.net>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Greg KH <greg@kroah.com>
Cc: Theodore Tso <tytso@MIT.EDU>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: James Morris <jmorris@namei.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-01-10 16:30:54 -08:00
..
ABI rtc/ab8500: add calibration attribute to AB8500 RTC 2012-01-10 16:30:52 -08:00
accounting Documentation: update cgroupfs mount point 2011-06-15 21:52:50 -07:00
acpi ACPI, APEI, EINJ Param support is disabled by default 2011-08-03 11:15:59 -04:00
aoe
arm ARM: move iotable mappings within the vmalloc region 2011-11-26 19:21:26 -05:00
auxdisplay
blackfin doc: fix broken references 2011-09-27 18:08:04 +02:00
block Documentation: drop as block elevator reference in switching-sched.txt 2011-11-04 12:01:48 -07:00
blockdev cciss: auto engage SCSI mid layer at driver load time 2011-11-16 09:21:49 +01:00
cdrom doc: fix broken references 2011-09-27 18:08:04 +02:00
cgroups Merge branch 'for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup 2012-01-09 12:59:24 -08:00
connector
console
cpu-freq Doc: cpufreq: Fix typo and outdated line 2011-11-08 10:23:29 +01:00
cpuidle
cris
crypto
development-process Documentation: Update stable address 2011-12-12 14:14:31 -08:00
device-mapper dm log userspace: fix comment hyphens 2011-10-31 20:21:22 +00:00
devicetree drivers/rtc/rtc-twl.c: add DT support for RTC inside twl4030/twl6030 2012-01-10 16:30:53 -08:00
DocBook Merge branch 'core-debugobjects-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2012-01-06 07:53:34 -08:00
driver-model lib: devres: add convenience function to remap a resource 2011-11-15 16:07:39 -08:00
dvb [media] update az6027 firmware URL 2011-10-14 10:29:45 -03:00
early-userspace
fault-injection fault-injection: update documentation with the mmc module param 2011-10-26 16:32:13 -04:00
fb udlfb: Enable fbcon access to framebuffer by default 2011-08-24 10:12:38 +00:00
filesystems procfs: add hidepid= and gid= mount options 2012-01-10 16:30:54 -08:00
firmware_class
frv doc: fix broken references 2011-09-27 18:08:04 +02:00
hid HID: Move hiddev.txt to the new Documentation/hid directory 2011-03-22 11:43:51 +01:00
hwmon hwmon: (pmbus/zl6100) Add support for Ericsson BMR45[0,1] and BMR46[2,3,4] 2012-01-05 08:19:28 -08:00
i2c i2c: Fix device name for 10-bit slave address 2011-11-23 11:33:07 +01:00
i2o doc: i2o: fix typo 'Settting' 2011-06-07 16:06:01 +02:00
ia64 Fix common misspellings 2011-03-31 11:26:23 -03:00
ide
infiniband
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2011-10-27 08:44:20 +02:00
ioctl ioctl: register LTTng ioctl 2011-09-12 11:50:56 -07:00
isdn doc: fix wrong arch/i386 references 2011-06-13 13:43:05 +02:00
ja_JP Merge branch 'driver-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 2011-07-25 23:06:24 -07:00
kbuild doc: fix wrong arch/i386 references 2011-06-13 13:43:05 +02:00
kdump [S390] Add s390x description to Documentation/kdump/kdump.txt 2011-12-27 11:27:13 +01:00
ko_KR
laptops Documentation: thinkpad-acpi grammo fixes 2011-11-04 12:01:47 -07:00
leds Documentation: fix leds-class.txt duplicated word 2011-11-04 12:01:48 -07:00
m68k Documentation: add pointer to name_to_dev_t for root= values 2011-08-03 14:25:21 -10:00
make
mips Fix common misspellings 2011-03-31 11:26:23 -03:00
misc-devices Fix common misspellings 2011-03-31 11:26:23 -03:00
mmc mmc: documentation of mmc non-blocking request usage and design. 2011-07-21 10:34:52 -04:00
mn10300
mtd
namespaces
netlabel
networking bonding: document undocumented active_slave sysfs entry. 2011-12-26 20:09:35 -05:00
nfc
parisc
PCI doc: fix broken references 2011-09-27 18:08:04 +02:00
pcmcia
power PM: Run the driver callback directly if the subsystem one is not there 2011-12-21 22:01:05 +01:00
powerpc Fix common misspellings 2011-03-31 11:26:23 -03:00
pps
prctl
pti Kernel documentation for the PTI feature. 2011-05-13 16:31:00 -07:00
ptp ptp: Added a brand new class driver for ptp clocks. 2011-05-23 13:01:00 -07:00
rapidio RapidIO: documentation update 2011-11-02 16:07:02 -07:00
RCU docs: Additional LWN links to RCU API 2011-12-11 10:32:23 -08:00
s390 [S390] Remove Kerntypes leftovers 2011-12-27 11:27:12 +01:00
scheduler sched: Add documentation for bandwidth control 2011-08-14 12:03:58 +02:00
scsi Merge branch 'master' into for-next 2011-11-13 20:55:53 +01:00
security doc: fix broken references 2011-09-27 18:08:04 +02:00
serial serial/documentation: fix documented name of DCD cpp symbol 2012-01-04 16:26:32 -08:00
sh
sound Merge branch 'fix/asoc' into for-linus 2011-12-06 13:22:28 +01:00
sparc
spi doc: fix broken references 2011-09-27 18:08:04 +02:00
sysctl kernel/sysctl.c: add cap_last_cap to /proc/sys/kernel 2011-10-31 17:30:53 -07:00
target [SCSI] tcm_mod_builder.py: Fix generated *_drop_nodeacl() handler 2011-03-23 11:36:45 -05:00
telephony Fix common misspellings 2011-03-31 11:26:23 -03:00
thermal
timers doc: fix broken references 2011-09-27 18:08:04 +02:00
trace mm-tracepoint: fix documentation and examples 2012-01-10 16:30:41 -08:00
usb USB: update documentation for usbmon 2012-01-04 16:04:30 -08:00
vDSO Document the vDSO and add a reference parser 2011-07-14 17:57:09 -07:00
video4linux [media] gspca - zc3xx: New webcam 03f0:1b07 HP Premium Starter Cam 2011-09-23 23:31:12 -03:00
virtual KVM: Don't automatically expose the TSC deadline timer in cpuid 2011-12-26 13:27:44 +02:00
vm Merge branches 'slab/next' and 'slub/partial' into slab/for-linus 2011-10-26 18:09:12 +03:00
w1 Fix common misspellings 2011-03-31 11:26:23 -03:00
watchdog Documentation: watchdog: add guide how to convert drivers to new framework 2011-11-05 21:25:16 +01:00
wimax
x86 x86-64, doc: Remove int 0xcc from entry_64.S documentation 2011-08-16 08:04:08 -07:00
zh_CN remove the messy code file Documentation/zh_CN/SubmitChecklist 2011-09-26 16:18:41 -07:00
.gitignore
00-INDEX Documentation: add Ramoops usage description 2011-08-13 18:34:03 -07:00
applying-patches.txt
atomic_ops.txt doc: Add load/store guarantees to Documentation/atomic-ops.txt 2011-12-11 10:31:58 -08:00
bad_memory.txt
basic_profiling.txt
binfmt_misc.txt
braille-console.txt
bt8xxgpio.txt
btmrvl.txt
BUG-HUNTING
bus-virt-phys-mapping.txt doc: fix broken references 2011-09-27 18:08:04 +02:00
cachetlb.txt mm: convert mm->cpu_vm_cpumask into cpumask_var_t 2011-05-25 08:39:21 -07:00
Changes Documentation/Changes: remove some really obsolete text 2011-07-11 16:48:38 -07:00
circular-buffers.txt
coccinelle.txt
CodingStyle Documentation: update CodingStyle use of braces 2011-11-04 12:01:47 -07:00
cpu-hotplug.txt Fix common misspellings 2011-03-31 11:26:23 -03:00
cpu-load.txt
cputopology.txt
dcdbas.txt
debugging-modules.txt
debugging-via-ohci1394.txt
dell_rbu.txt Fix common misspellings 2011-03-31 11:26:23 -03:00
devices.txt devices.txt: Fix typo of 'VMware'. 2011-12-09 11:21:32 +01:00
DMA-API-HOWTO.txt Documentation/DMA-API-HOWTO.txt: fix misleading example 2011-07-26 16:49:45 -07:00
DMA-API.txt include/linux/dma-mapping.h: add dma_zalloc_coherent() 2011-11-02 16:07:02 -07:00
DMA-attributes.txt
dma-buf-sharing.txt dma-buf: Documentation for buffer sharing framework 2012-01-06 10:20:24 +00:00
DMA-ISA-LPC.txt
dmaengine.txt Improve slave/cyclic DMA engine documentation 2011-07-27 20:33:48 +05:30
dontdiff [S390] Remove Kerntypes leftovers 2011-12-27 11:27:12 +01:00
dynamic-debug-howto.txt Merge branch 'docs-next' of git://git.lwn.net/linux-2.6 2011-03-27 19:46:59 -07:00
edac.txt Merge branch 'for-linus2' of git://git.profusion.mobi/users/lucas/linux-2.6 2011-04-07 11:14:49 -07:00
eisa.txt Fix common misspellings 2011-03-31 11:26:23 -03:00
email-clients.txt Documentation: email-clients: Add better Thunderbird information 2011-08-13 18:34:03 -07:00
feature-removal-schedule.txt Merge branch 'usb-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 2012-01-09 12:09:47 -08:00
flexible-arrays.txt flex_array: flex_array_prealloc takes a number of elements, not an end 2011-04-28 16:12:47 -04:00
futex-requeue-pi.txt
gcov.txt
gpio.txt
highuid.txt
HOWTO Documentation: Update stable address 2011-12-12 14:14:31 -08:00
hw_random.txt
hwspinlock.txt hwspinlock/core: register a bank of hwspinlocks in a single API call 2011-09-21 19:45:34 +03:00
init.txt
initrd.txt
intel_txt.txt
Intel-IOMMU.txt
io_ordering.txt
io-mapping.txt
iostats.txt Documentation/iostats.txt: bit-size reference etc. 2011-03-23 20:44:18 +01:00
IPMI.txt
IRQ-affinity.txt bitmap, irq: add smp_affinity_list interface to /proc/irq 2011-05-25 08:39:45 -07:00
IRQ.txt
irqflags-tracing.txt Fix common misspellings 2011-03-31 11:26:23 -03:00
isapnp.txt
java.txt
kernel-doc-nano-HOWTO.txt
kernel-docs.txt doc: fix broken references 2011-09-27 18:08:04 +02:00
kernel-parameters.txt mm: more intensive memory corruption debugging 2012-01-10 16:30:42 -08:00
kmemcheck.txt
kmemleak.txt Documentation: update kmemleak supported archs 2011-06-15 21:52:50 -07:00
kobject.txt
kprobes.txt
kref.txt kref: Fix typo in kref documentation 2011-03-07 13:20:05 -08:00
ldm.txt
local_ops.txt
lockdep-design.txt lockdep: Update documentation for lock-class leak detection 2011-12-11 10:31:23 -08:00
lockstat.txt Documentation: Add statistics about nested locks 2011-05-28 17:03:29 +02:00
logo.gif
logo.txt
magic-number.txt doc: fix wrong arch/i386 references 2011-06-13 13:43:05 +02:00
Makefile
ManagementStyle
mca.txt doc: fix wrong arch/i386 references 2011-06-13 13:43:05 +02:00
md.txt md: create externally visible flags for supporting hot-replace. 2011-12-23 10:17:51 +11:00
media-framework.txt doc: fix broken references 2011-09-27 18:08:04 +02:00
memory-barriers.txt doc: fix broken references 2011-09-27 18:08:04 +02:00
memory-hotplug.txt
memory.txt
mono.txt
mutex-design.txt
nmi_watchdog.txt
nommu-mmap.txt
numastat.txt
oops-tracing.txt module,bug: Add TAINT_OOT_MODULE flag for modules not built in-tree 2011-11-07 07:54:42 +10:30
padata.txt
parport-lowlevel.txt
parport.txt
pi-futex.txt
pinctrl.txt drivers: create a pin control subsystem 2011-10-13 12:49:17 +02:00
pnp.txt
preempt-locking.txt
printk-formats.txt Documentation: update printk-formats.txt 2011-06-15 21:52:50 -07:00
prio_tree.txt
ramoops.txt Documentation: add Ramoops usage description 2011-08-13 18:34:03 -07:00
rbtree.txt Documentation: Update augmented rbtree documentation 2011-07-24 10:03:05 -07:00
rfkill.txt doc: fix broken references 2011-09-27 18:08:04 +02:00
robust-futex-ABI.txt
robust-futexes.txt
rt-mutex-design.txt
rt-mutex.txt
rtc.txt RTC: Fix up rtc.txt documentation to reflect changes to generic rtc layer 2011-03-09 11:25:10 -08:00
SAK.txt
SecurityBugs Fix common misspellings 2011-03-31 11:26:23 -03:00
serial-console.txt
sgi-ioc4.txt
sgi-visws.txt
SM501.txt
sparse.txt
spinlocks.txt Documentation/spinlocks.txt: Remove reference to sti()/cli() 2011-07-11 12:45:04 -07:00
stable_api_nonsense.txt doc: stable_api_nonsense.txt: fix paragraph to make more sense. 2011-03-30 12:02:05 +02:00
stable_kernel_rules.txt Update email address for stable patch submission 2011-10-18 13:58:59 -07:00
SubmitChecklist Documentation/SubmitChecklist: add RCU debug config options 2011-07-25 20:57:17 -07:00
SubmittingDrivers Documentation: SubmittingDrivers: fix Linus's git tree URL 2011-08-13 18:34:03 -07:00
SubmittingPatches Documentation: fix spelling error in SubmittingPatches 2011-08-13 18:34:02 -07:00
svga.txt
sysfs-rules.txt
sysrq.txt
unaligned-memory-access.txt
unicode.txt
unshare.txt
VGA-softcursor.txt
vgaarbiter.txt misc latin1 to utf8 conversions 2012-01-02 13:04:55 +01:00
video-output.txt
volatile-considered-harmful.txt
workqueue.txt workqueue: Document debugging tricks 2011-03-31 13:40:42 +02:00
xz.txt
zorro.txt