Messages in this thread | | | From | Giuseppe Scrivano <> | Subject | Re: [PATCH v3 1/2] exec: add PR_HIDE_SELF_EXE prctl | Date | Mon, 23 Jan 2023 20:21:28 +0100 |
| |
"Colin Walters" <walters@verbum.org> writes:
> On Fri, Jan 20, 2023, at 5:25 AM, Giuseppe Scrivano wrote: >> This patch adds a new prctl called PR_HIDE_SELF_EXE which allows >> processes to hide their own /proc/*/exe file. When this prctl is >> used, every access to /proc/*/exe for the calling process will >> fail with ENOENT. > > How about a mount option for procfs like `mount -t procfs procfs /proc -o rw,nosuid,nodev,magiclink-no-xdev` > > Where `magiclink-no-xdev` would cause all magic links to fail to cross a pid namespace or so?
wouldn't that break also stuff like "/proc/self/fd/$FD" after you join a different PID namespace?
| |