Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is it possible to disable the /proc pseudo-filesystem to prevent w, ps, top, etc, from showing what other users are doing? Of course, I still want "everything else" to work correctly. Is there a workable way to do this?

share|improve this question
add comment

2 Answers

up vote 7 down vote accepted

There is the grsecurity patchset (included in SELinux, but doesn't have the latter's horribly complicated MAC permission system) for the Linux kernel which offers the option of allowing only the owner (and root) to see his/her processes. It also offers other goodies without being as intrusive as SELinux.

A similar option is there on Solaris, or so I heard.

share|improve this answer
1  
For Solaris, see How to Limit Display of Other User's Processes to configure which users can see what other users are doing. –  alanc May 5 '13 at 4:10
add comment

If you disable /proc, a lot of things will stop working. Not only will you not be able to use ps and company, even to see your own processes, but a lot of tools and services will not be able to run. Looking at the computer I'm writing this on, processes that have a file under /proc open include mdadm (RAID), Xorg (GUI), hald (hotpluggable devices), acpid (ACPI), rpc.mount (NFS server).

It might be workable to give /proc permissions 550 (i.e. non-world-readable), group proc-readers, and put all the services that use /proc but aren't running as root in the proc-readers group. I've never tried; this is an experiment proposal, not something to do on a production machine.

Use SELinux or virtualization to further isolate users.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.