How to block users from seeing others processes?
Generally it's one of the functionalities of (For example) grsecurity - user sees only his own processes, and not all others.
But - I'd prefer to avoid installing grsecurity - perhaps something like this can be done in a simpler way?
I'm using Linux Debian.
no need for containers, just use a somehow recent OS https://linux-audit.com/linux-system-hardening-adding-hidepid-to-proc/
https://www.linux-dev.org/2012/09/hide-process-information-for-other-users/
hidepid is an new mount option for the procfs (/proc), with that you can hide processes and its information to other users, like other shell users and to web scripts.
hidepid accepts three different values:
hidepid=0 (default): This is the default setting and gives you the default behaviour.
hidepid=1: With this option an normal user would not see other processes but their own about ps, top etc, but he is still able to see process IDs in /proc
hidepid=2: Users are only able too see their own processes (like with hidepid=1), but also the other process IDs are hidden for them in /proc!
Additionaly you can specifiy an user/group ID which is still able to look up the processes with the gid option. So if you want to hide all processes to other users, except root (uid=0) and in this example gid=1001 (some semi administrative user in this example) your /etc/fstab has to look like this:
proc /proc proc defaults,hidepid=2,gid=1001 0 0
Depending on what you're trying to accomplish, you may want to look into Linux Containers:
- http://lxc.sourceforge.net/
This is a lightweight virtualization mechanism that lets you created isolated groups of resources on your Linux system. Linux containers (LXC) uses the namespace support that has been in the Linux kernel for the past several years; this page:
- http://lxc.sourceforge.net/index.php/about/kernel-namespaces/
Has links to articles discussing various aspects of this work.
This may end up being a bigger solution than you're looking for, but it's a very interesting technology.