[lkml]   [2005]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Subject[PATCH][0/6] Change proc file permissions with sysctls
    The following patches implement another interface that allows an admin
    to restrict permissions inside /proc/<pid> to enhance the privacy of
    users. Following a suggestion by Albert Calahan this set of patches
    introduces five sysctls, each one changes the permissions of a certain
    file in /proc/<pid>.

    It works by implementing getattr and permission methods that update the
    files' permissions (btw. Al Viro suggested doing it this way right from
    the start..).

    To "cloak" as much as currently possible:

    # sysctl -q proc.cmdline=0400
    # sysctl -q proc.maps=0400
    # sysctl -q proc.stat=0400
    # sysctl -q proc.statm=0400
    # sysctl -q proc.status=0400

    This will set the permissions of /proc/*/cmdline etc. to the given

    The permissions of files in /proc/1 (usually belonging to init) are
    kept as they are. The idea is to let system processes be freely
    visible by anyone, just as before. Especially interesting in this
    regard would be instances of login. I don't know how to easily
    discriminate between system processes and "normal" processes inside
    the kernel (apart from pid == 1 and uid == 0 (which is too broad)).
    Any ideas?

    It's easy to make more files' permissions configurable, if the need

    This implementation is a lot bigger than the quick hacks I sent earlier.
    Is this feature growing too fat? Also I'm unsure about the #ifdef'ery
    in fs/proc/base.c, I just wanted to be consistent with the surrounding
    code. :-P


    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:11    [W:0.020 / U:15.044 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site