Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is it possible to configure process hiding for certain user groups under a linux system?

For example: Users from group X should not see processes owned by users from group Y in ps/top or under /proc.

Is it possible to configure such a setup with SELinux?

(I vaguely remember a similar feature in the funny grsecurity patch set - but IIRC, it was more generic - and besides, I want to configure a stock linux distro without having to maintain a custom kernel.)

Edit: For better illustration, Solaris 10 has a similar feature. The example is not that generic, but one can configure that a user or some users can only see information of their own processes in ps etc.

share|improve this question
1  
I don't know but the best source of SELinux info is probably the book (amazon link) SELinux by Example: Using Security Enhanced Linux –  xenoterracide Aug 27 '10 at 21:19
    
Grsecurity does this for single users except root. –  stribika Mar 4 '11 at 22:29
    
Similar question with more answers: unix.stackexchange.com/questions/17164/… –  jofel Mar 15 '12 at 9:34
add comment

2 Answers 2

up vote 2 down vote accepted

Actually, SELinux seems to allow such configurations:

From the first Howto:

This time, you will see all processes on the system regardless of the domain they are in. When in sysadm_t domain, you have access to other domains which the user_t domain does not.

From the second Howto:

The third line allows staff_t to run ps and see processes in the unprivileged user domains. staff_t is able to run ps and see everything in user_t and other user domains if any, whereas user_t can not.

share|improve this answer
add comment

Without a rootkit, or without hacking the kernel to specifically allow that behavior, there are not any pre-packaged options.

If these are processes launched from code you have access to then you may be able to recompile it while altering the argv[0] argument passed into the program. This could effectively change the name to something benign and thus "hide" it from anyone checking top or ps, etc.

share|improve this answer
    
actually, there are pre-packaged options ... ;) See my answer for details ... –  maxschlepzig Oct 9 '10 at 23:26
    
@maxschlepzig, thanks for linking to those. I had no idea. –  Shamster Oct 21 '10 at 19:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.