12

I'm currently comparing random PID implementation on OpenBSD, FreeBSD and Linux from security perspective.

As long as OpenBSD and FreeBSD are concerned, my work is done. However, while the answer here states that random PID can be enabled on Linux just thanks to a sysctl setting, I was not able to determine which setting it is.

Researches on Internet only lead to patches and discussions rejected in the mainstream Linux kernel, and it does not appear in the grsecurity features either (and obviously on my Linux boxes PIDs are incremental everywhere, with no sysctl parameter name seeming related, and a few searches in the kernel source did not show anything relevant).

Is PID randomization really available on Linux?

  • What is the benefit? – jordanm May 28 '15 at 13:36
  • 3
    @jordanm: Warm, fuzzy feelings of security. See the recent discussion about that on the OpenBSD misc list for some perspective. – lcd047 May 28 '15 at 13:39
  • 1
    @jordanm: That's precisely what I'm investigating ;). For some people it seems to be a mandatory basis for a secure system, for other something useless, and some consider it to be even something negative. Sadly nobody seems to have a concrete answer on Security SE so I finally had to answer myself with a yet-to-complete answer since I found at least interesting differences in the OpenBSD and FreeBSD approaches, and was therefore curious of the mentioned Linux version of random PIDs (if there is really one). – WhiteWinterWolf May 28 '15 at 13:43
  • @lcd047: I know this discussion very well since I was the guy "trolling" that list by trying to understand and compare the different choices made by different OSes. – WhiteWinterWolf May 28 '15 at 13:47
  • @WhiteWinterWolf: For Linux, one of the popular kernel patches used to do that at some point. I recall that patch being grsecurity, but I might be wrong. I haven't really looked at Linux all that closely in a few years. – lcd047 May 28 '15 at 13:53
8

PID randomization was never available in the mainstream Linux kernel. Apart from individual initiatives, for several years it was mainly available through grsecurity kernel patch, however it was removed in the late 2006:

grsecurity 2.1.10 was released today for Linux 2.4.34 and 2.6.19.2. Changes in this release include:

  • Removal of randomized PIDs feature, since it provides no useful additional security and wastes memory with the 2.6 kernel's pid bitmap

This completes my randomized PID implementation comparison between Linux, OpenBSD and FreeBSD :).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.