Hiding processes from other users
Posted by Steve on Thu 13 Mar 2014 at 08:58
If you run a multi-user system it can increase security if you hide the display of running processes, and their arguments, which belong to other users. This helps avoid problems if users enter passwords on the command-line, and similar.
If you're running a recent Kernel, (version 3.2 or higher), you can achieve this benefit by mounting the /proc filesystem with the new hidepid option:
This is the default setting and gives you the default behaviour.
With this option a normal user would not see other processes but their own in ps, top etc, but would is still be able to see process IDs beneath /proc
Users are only able to see their own processes (as with with hidepid=1), but also any other process IDs are hidden for them if they manually poke around beneath /proc
It is worth noting that with the secure values set ("1", or "2") all processes remain visible to the root user.
If you decide you wish to enable this protection you can change the mount option interactively by running:
# mount -o remount /proc -o hidepid=2
To ensure this happens automatically at boot-time you can update your /etc/fstab file to read something like this:
proc /proc proc defaults,hidepid=2 0 0
With this in place a user will only see their own processes in the output of top, ps, & etc:
s-blog@www:~$ ps -ef UID PID PPID C STIME TTY TIME CMD s-blog 848 32483 0 08:55 pts/1 00:00:00 ps -ef s-blog 32483 32482 0 08:54 pts/1 00:00:00 -bash
The root user will still see all processes though, for debugging purposes.
According to a recent post from the Debian Security Team it seems likely that the hidepid option will be proposed as a default in the future.