What is the best way to restrict /proc fs from malicious users (linux)?

Question

I am trying to make a restriction to procfs like only a certain groups of members can perform read and write actions.

kernel document says we can do that by setting hidepid and gid in /etc/fstab. It will restrict the malicious user from making read and write on procfs but I have a doubt whether it is possible for malicious user (restricted in the /etc/fstab) to access content in profs using syscall instead of fs operation like read and write.

What end specifically are you trying to prevent malicious users from doing? Accessing /proc isn't the end; it's the means to the end. — Joseph Sible-Reinstate Monica, Mar 14 '20 at 15:36
@JosephSible-ReinstateMonica there is multiple end. for example you can take malicious user should not read other users cmdline value which will be in `/proc//cmdline` or you can also take malicious user should not read other users environ value which will be in `/proc//environ`. — Karthik Nedunchezhiyan, Mar 14 '20 at 15:42
Why do you think `hidepid=2` isn't good enough to stop that? — Joseph Sible-Reinstate Monica, Mar 14 '20 at 15:45
Yes while reading it sounds good, but I need to double-check is this option is sufficient. Is there any other way a malicious user can view the `environment value (environ)` of other users using syscall or any other way? — Karthik Nedunchezhiyan, Mar 14 '20 at 15:47
Why do you think `hidepid` isn't effective against syscalls, when they're the normal way to read from there? — Joseph Sible-Reinstate Monica, Mar 14 '20 at 15:52
Hmm, this is because I have no in-depth knowledge about procfs. Are you sure `hidepid` is sufficient? — Karthik Nedunchezhiyan, Mar 14 '20 at 15:58

score 1 · Answer 1 · answered Mar 14 '20 at 17:36

In general, hidepid mentioned in the comments is the best way.

If you need more security than that, use a mandatory access control system like SELinux or AppArmor, and possibly systrace. These tools let you restrict file system access, syscalls and more. I think most of the info in /proc is not available from syscalls, but I'm not up-to-date on this.

MAC tools are not "click and go" solutions and require quite a lot of work to configure. Before you embark on this, have a think about whether this is the best way to invest your security resources.

What is the best way to restrict /proc fs from malicious users (linux)?

1 Answers1