I have one big problem: setfacl does not seem to work for /proc and /sys, but I would like to restrict one specific users rights and I do not find it acceptable for that user to read stuff like /proc/cpuinfo etc. (The user should not be able to gather hardware information about the system)
How would I do this in Ubuntu? Apparmor is more for restricting applications, but not users. It seems Selinux is the only possibility in this case, right?
I have worked around in my script this way:
# restrict read access to /sys and /proc
sudo chmod -r /sys
sudo chmod -r /proc/acpi
sudo chmod -r /proc/asound
sudo chmod -r /proc/bus
sudo chmod -r /proc/cgroups
sudo chmod -r /proc/consoles
sudo chmod -r /proc/cpuinfo
sudo chmod -r /proc/crypto
sudo chmod -r /proc/devices
sudo chmod -r /proc/diskstats
sudo chmod -r /proc/dma
sudo chmod -r /proc/dri
sudo chmod -r /proc/driver
sudo chmod -r /proc/execdomains
sudo chmod -r /proc/fb
sudo chmod -r /proc/filesystem
# ...
Now I wonder, if this could create serious problems if I simply remove the read access to those files (I only remove read rights for files that have names, not for the number directories), apart from some system monitoring tools not working with user rights (like top, lscpu)?
Apart from the issues that creates for other users, this solution is utterly inelegant.
I do not want to compile and maintain a grsecurity kernel either, that creates too much trouble.
cpuid
command; it does not require access to anything under /proc or /sys. You might need to put the user in a VM.