3

I have written own init process (pid 1) for my system, to improve security I decided to add hidepid=2 while mounting procfs in /proc location (procfs not mounted by default).

After mounting the procfs I ran the mount command to check everything mount fine with given mount option, I noticed hidepid=2 was not listed in option. After some time I found hidepid=2 is able to add in list only after remount.

I also confirmed the behavior using command line too, like below

  • initially /proc was not mounted with procfs
  • executed mount -t proc -o hidepid=2 proc /proc
  • executed mount, showed proc on /proc type proc (rw,relatime)
  • executed mount -t proc -o remount,hidepid=2 proc /proc
  • executed mount, showed proc on /proc type proc (rw,relatime,hidepid=2)

Anyone kindly explain me why I was not able to mount procfs with hidepid=2 in single attempt?

1 Answer 1

4
+50

There is a commit in the Linux kernel (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=69879c01a0c3f70e0887cfb4d9ff439814361e46) that says:

In addition removing the unnecessary complexity of the kernel mount fixes a regression that caused the proc mount options to be ignored. Now that the initial mount of proc comes from userspace, those mount options are again honored. This fixes Android's usage of the proc hidepid option.

So it seems this is a bug in the Linux kernel and currently (https://github.com/torvalds/linux/commit/69879c01a0c3f70e0887cfb4d9ff439814361e46), it is fixed only in the release candidate tags of the v5.7 version (v5.7-rc4, v5.7-rc3, v5.7-rc2 and v5.7-rc1).

2
  • Also, thanks to noodly from #gynvaelstream on freenode who pointed out this commit (but didn't have an account here to post an answer) :). May 6, 2020 at 11:04
  • Does this commit mean one can now use options to mount procps on /proc? If so, how? (I suppose systemd mounts /proc now on Systemd systems like mine, does it have a config option perhaps?)
    – Ned64
    Mar 2, 2021 at 23:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .