Make linux process invisible with new Centos kernel
Processes carry out tasks within the operating system. A program is a set of machine code instructions and data stored in an executable image on disk and is, as such, a passive entity; a process can be thought of as a computer program in action.
After I have compiled the new version of Centos 3.2 kernel I have decided to test some security features that this version offers. How to check which kernel version you have installed, well easy:
[root@centos01 ~]# uname -r
3.2.48
[root@centos01 ~]#
As many other Linux servers, they run in a multi-user enviroments. That means that every user are using shared hardware and software resources of the server. From a security stand point of view, informations of user/usage processes ownership is not relevant for every user to see it. To prevent these informations to every shared resource we are going to tamper a little bit with the /proc filesystem. So if you have the Centos 3.2+ kernel compiled and installed on your test or production machine you can develope this situation further.
The task is simple, all we have to configure is the /proc file system mount with new security options, so that reading of every process can be delegated only to the owner of the process. The new option that we are going to introduce is hidepid.
We have three options available:
hidepid=0 - anyone can read the /proc/pid files
hidepid=1 - this option prevents users to access /proc directories , except of their own. Important
background tasks of the server are now prevented to be shown.
hidepid=2 - this option is an addition to the option 1 , with more security, denying everybody the information about the running processes. Now an intruder is not able to list sensitive data.
Before setting this security options we had a normal situation where a local user could read all of the root and system processes informations.
To continue setting this to prevent users information leakage we have to type further commands:
mount -o remount,rw,hidepid=2 /proc
To have the configuration over a rebooted server we have to update the FSTAB file.
vi /etc/fstab
And we have to add the following info to the file:
proc /proc proc defaults,hidepid=2 0 0
Save and update the file.
This is all to it. Log into a stanard user and use the following command to list the processes:
ps -ef
As a standard user you should not be able to see the processes from other users and applications.
Feel free to test and comment.
