0

I have one big problem: setfacl does not seem to work for /proc and /sys, but I would like to restrict one specific users rights and I do not find it acceptable for that user to read stuff like /proc/cpuinfo etc. (The user should not be able to gather hardware information about the system)

How would I do this in Ubuntu? Apparmor is more for restricting applications, but not users. It seems Selinux is the only possibility in this case, right?

I have worked around in my script this way:

# restrict read access to /sys and /proc
sudo chmod -r /sys
sudo chmod -r /proc/acpi
sudo chmod -r /proc/asound
sudo chmod -r /proc/bus
sudo chmod -r /proc/cgroups
sudo chmod -r /proc/consoles
sudo chmod -r /proc/cpuinfo
sudo chmod -r /proc/crypto
sudo chmod -r /proc/devices
sudo chmod -r /proc/diskstats
sudo chmod -r /proc/dma
sudo chmod -r /proc/dri
sudo chmod -r /proc/driver
sudo chmod -r /proc/execdomains
sudo chmod -r /proc/fb
sudo chmod -r /proc/filesystem
# ...

Now I wonder, if this could create serious problems if I simply remove the read access to those files (I only remove read rights for files that have names, not for the number directories), apart from some system monitoring tools not working with user rights (like top, lscpu)?

Apart from the issues that creates for other users, this solution is utterly inelegant.

I do not want to compile and maintain a grsecurity kernel either, that creates too much trouble.

7
  • I second @Rinzwind. Restrict that user to a chroot or something. – muru Jul 5 '14 at 19:12
  • Rinzwind, what do you mean by "restrict the user to his /home/"? – Esokrates Jul 5 '14 at 19:23
  • 1
    chroot, is 1.) not secure 2.) takes a lot of unnecessary space. I simply want a user not to be able to gather hardware information. – Esokrates Jul 5 '14 at 19:47
  • 2
    @GEO and what would this minimal image have that you can't get by bind mounts? – muru Jul 5 '14 at 20:01
  • 2
    If you're on an x86, denying access to /proc/cpuinfo won't prevent users from getting CPU info, because there's still the CPUID instruction. Run the cpuid command; it does not require access to anything under /proc or /sys. You might need to put the user in a VM. – Mark Plotnick Jul 6 '14 at 22:08
4

To restrict access to /proc, you use the hidepid option while mounting /proc. Add to your fstab (or edit if there's already an entry):

proc /proc proc defaults,hidepid=2 0 0

You can use the gid option to enable access for a particular group. See http://www.debian-administration.org/article/702/Hiding_processes_from_other_users for more details.

7
  • This is a far better method! Though I would still chroot that user ;) – Rinzwind Jul 5 '14 at 19:17
  • While I really appreciate your answer, I do not see how information like cpuinfo is protected for one specific user though ... – Esokrates Jul 5 '14 at 19:29
  • 1
    @GEO True, this is for all users. You can however, add all the other users to some group and use the gid option. – muru Jul 5 '14 at 19:31
  • 1
    @GEO Sorry about that. That's where I first learnt of this, so that's the post I usually link to. kernel.org/doc/Documentation/filesystems/proc.txt has more information. I'll add this to the answer. – muru Jul 5 '14 at 19:37
  • 1
    @GEO hmmm. That is a lot more restrictive than the hidepid option allows. If the user is accessing the system via SSH, you might want to look at the second answer here: stackoverflow.com/questions/833247/how-to-jail-linux-user – muru Jul 5 '14 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.