I have one big problem: setfacl does not seem to work for /proc and /sys, but I would like to restrict one specific users rights and I do not find it acceptable for that user to read stuff like /proc/cpuinfo etc. (The user should not be able to gather hardware information about the system)
How would I do this in Ubuntu? Apparmor is more for restricting applications, but not users. It seems Selinux is the only possibility in this case, right?
I have worked around in my script this way:
# restrict read access to /sys and /proc sudo chmod -r /sys sudo chmod -r /proc/acpi sudo chmod -r /proc/asound sudo chmod -r /proc/bus sudo chmod -r /proc/cgroups sudo chmod -r /proc/consoles sudo chmod -r /proc/cpuinfo sudo chmod -r /proc/crypto sudo chmod -r /proc/devices sudo chmod -r /proc/diskstats sudo chmod -r /proc/dma sudo chmod -r /proc/dri sudo chmod -r /proc/driver sudo chmod -r /proc/execdomains sudo chmod -r /proc/fb sudo chmod -r /proc/filesystem # ...
Now I wonder, if this could create serious problems if I simply remove the read access to those files (I only remove read rights for files that have names, not for the number directories), apart from some system monitoring tools not working with user rights (like top, lscpu)?
Apart from the issues that creates for other users, this solution is utterly inelegant.
I do not want to compile and maintain a grsecurity kernel either, that creates too much trouble.