How to change permission of /proc/self/pagemap file?

Question

I want to change the pagemap file permission to 755 or 744 using sudo chmod. But the command is throwing error saying operation not permitted. The motivation is to allow a user read the pagemap file (of its own) without giving sudo access.

When the user have sudo access it is working, he allowed to read pagemap file. But I want to prevent the user to have sudo access, but should allow him to read this pagemap file alone.

Answer 1

The Linux kernel requires sudo for /proc/<pid>/pagemap since 4.0

This is documented at: https://github.com/torvalds/linux/blob/v4.9/Documentation/vm/pagemap.txt

   Since Linux 4.0 only users with the CAP_SYS_ADMIN capability can get PFNs.
   In 4.0 and 4.1 opens by unprivileged fail with -EPERM.  Starting from
   4.2 the PFN field is zeroed if the user does not have CAP_SYS_ADMIN.
   Reason: information about PFNs helps in exploiting Rowhammer vulnerability.

Where CAP_SYS_ADMIN basically means "run as sudo", or alternatively:

sudo setcap cap_sys_admin+ep program_that_uses_pagemap
./program_that_uses_pagemap

Keep in mind that /proc is a virtual filesystem, and so the Linux kernel can choose to enforce additional permissions or even alter results arbitrarily for non root as it does here for security reasons by setting PFNs to zero.

Answer 2

you can try changing the permissions in the /etc/init/mounted-proc.conf file:

script
    chmod 0444 "${MOUNTPOINT}"/self/pagemap
end script

proc is a virtual filesystem generated by the kernel. If you can not change the permission it is not allowed by your kernel and you can only solve it by changing kernel.