0

I have one big problem: setfacl does not seem to work for /proc and /sys, but I would like to restrict one specific users rights and I do not find it acceptable for that user to read stuff like /proc/cpuinfo etc. (The user should not be able to gather hardware information about the system)

How would I do this in Ubuntu? Apparmor is more for restricting applications, but not users. It seems Selinux is the only possibility in this case, right?

I have worked around in my script this way:

# restrict read access to /sys and /proc
sudo chmod -r /sys
sudo chmod -r /proc/acpi
sudo chmod -r /proc/asound
sudo chmod -r /proc/bus
sudo chmod -r /proc/cgroups
sudo chmod -r /proc/consoles
sudo chmod -r /proc/cpuinfo
sudo chmod -r /proc/crypto
sudo chmod -r /proc/devices
sudo chmod -r /proc/diskstats
sudo chmod -r /proc/dma
sudo chmod -r /proc/dri
sudo chmod -r /proc/driver
sudo chmod -r /proc/execdomains
sudo chmod -r /proc/fb
sudo chmod -r /proc/filesystem
# ...

Now I wonder, if this could create serious problems if I simply remove the read access to those files (I only remove read rights for files that have names, not for the number directories), apart from some system monitoring tools not working with user rights (like top, lscpu)?

Apart from the issues that creates for other users, this solution is utterly inelegant.

I do not want to compile and maintain a grsecurity kernel either, that creates too much trouble.

7
  • I second @Rinzwind. Restrict that user to a chroot or something.
    – muru
    Jul 5, 2014 at 19:12
  • Rinzwind, what do you mean by "restrict the user to his /home/"?
    – Esokrates
    Jul 5, 2014 at 19:23
  • 1
    chroot, is 1.) not secure 2.) takes a lot of unnecessary space. I simply want a user not to be able to gather hardware information.
    – Esokrates
    Jul 5, 2014 at 19:47
  • 2
    @GEO and what would this minimal image have that you can't get by bind mounts?
    – muru
    Jul 5, 2014 at 20:01
  • 2
    If you're on an x86, denying access to /proc/cpuinfo won't prevent users from getting CPU info, because there's still the CPUID instruction. Run the cpuid command; it does not require access to anything under /proc or /sys. You might need to put the user in a VM. Jul 6, 2014 at 22:08

1 Answer 1

5

To restrict access to /proc, you use the hidepid option while mounting /proc. Add to your fstab (or edit if there's already an entry):

proc /proc proc defaults,hidepid=2 0 0

You can use the gid option to enable access for a particular group. See http://www.debian-administration.org/article/702/Hiding_processes_from_other_users for more details.

7
  • This is a far better method! Though I would still chroot that user ;)
    – Rinzwind
    Jul 5, 2014 at 19:17
  • While I really appreciate your answer, I do not see how information like cpuinfo is protected for one specific user though ...
    – Esokrates
    Jul 5, 2014 at 19:29
  • 1
    @GEO True, this is for all users. You can however, add all the other users to some group and use the gid option.
    – muru
    Jul 5, 2014 at 19:31
  • 1
    @GEO Sorry about that. That's where I first learnt of this, so that's the post I usually link to. kernel.org/doc/Documentation/filesystems/proc.txt has more information. I'll add this to the answer.
    – muru
    Jul 5, 2014 at 19:37
  • 1
    @GEO hmmm. That is a lot more restrictive than the hidepid option allows. If the user is accessing the system via SSH, you might want to look at the second answer here: stackoverflow.com/questions/833247/how-to-jail-linux-user
    – muru
    Jul 5, 2014 at 19:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .