22

Using ps -aux or top, I can list other users running processes, but I'm neither running as root nor making use of sudo, why?

29

By default, you can always list other users processes in Linux.

To change that, you need to mount proc in /etc/fstab with hidepid=2:

proc            /proc           proc    defaults,hidepid=2

This functionality is supported from the kernel v3.2 onwards. It hides /proc and consequentially ps activity from all users except root.

Taken from this article about hidepid:

hidepid=2 - It means hidepid=1 plus all /proc/PID/ will be invisible to other users. It compicates intruder's task of gathering info about running processes, whether some daemon runs with elevated privileges, whether another user runs some sensitive program, whether other users run any program at all, etc.

  • 1
    This solve the part "being able to list other users running process", but don't understand why this is not this way by default since the beginning. – Магисья Темная Леди Nov 20 '15 at 14:57
  • 7
    Because this breaks the Unix way and compatibility with some daemons. – Rui F Ribeiro Nov 20 '15 at 15:00
  • 4
    It's just an old tradition that a timesharing system would be an open community. – Barmar Nov 25 '15 at 19:53
  • If Mr. Bad Guy got to run programs on your system, it is game over anyway. This is just hiding stuff that is vital for normal functioning of the system. to give a cracker a bit of a nuisance. "Security theater" at it's most glorious. – vonbrand Feb 16 '16 at 0:33
  • I have been running a farm of servers like that, and actually your comment is giving me an idea for a good question. Will write it later on 3AM here, and it will take time to report my findings – Rui F Ribeiro Feb 16 '16 at 3:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.