Secure ProcFS Entries
From Linux-VServer
The Linux-VServer project provides a mechanism to protect entries in the proc filesystem from being seen in every context, this has been introduced in development release 1.3.5 and stable release 1.23.
The system consists of three flags: admin, watch and hide. To view/set these, a recent version of the util-vserver package, containing setattr and showattr, is required. (There is another tool called vproc, but this won't be discussed here). The logic behind these flags has been changed in experimental release 0.09, and new devel / stable releases that also use this logic, are coming soon, so the old logic won't be explained here (if you're running an older version of Linux-VServer, you probably already figured it out yourself anyways).
Note: When referring to the flags, I'll follow the syntax used by the showattr tool of the util-vserver package, where a means admin, w means watch and h means hide, also lower case means disabled and upper case means enabled.
Contents |
Flag logic (Linux-VServer 2.4 branch > 1.3.7 / 2.6 branch > 0.08)
The flags have the following meanings:
| Flag | Meaning |
|---|---|
| admin | always visible in context 0 |
| watch | always visible in context 1 |
| hide | hidden |
This means a mapping of flagging to visibility according to this table:
| Flags | Visibility |
|---|---|
| * * h | Visible everwhere (admin and watch flags don't matter) |
| A w H | Visible only in context 0 |
| a W H | Visible only in context 1 |
| A W H | Visible in contexts 0 and 1 |
| a w H | Totally invisible (cannot be reverted without rebooting!) |
Default flagging
As of now the stable vs1.2.x (2.4 kernel defaults to all proc entries visible everywhere, stable vs2.0.x (2.6 kernel), development and experimental versions default to all proc entries only visible in context 0 and 1.
Setting flags
To set those flags you'll need the setattr tool from a recent util-vserver package (0.30.193 works), the usage is pretty much self-explanatory from the command-line help. To make the /proc/loadavg entry visible everywhere, you have to unset the hide flag:
setattr --~hide /proc/loadavg
The admin and watch flag can be in any state as hiding is controlled by the hide flag only.
To keep vservers from reading the interrupt information, you need to hide the /proc/interrupts entry. If you want this to be accessible in the admin context (0) only use:
setattr --hide --admin --~watch /proc/interrupts
vprocunhide
With alpha util-vserver comes a tool called vprocunhide that sets reasonable flags for a number of proc entries that are generally needed to be visible. There is also an init script, normally located at /usr/local/etc/init.d/vprocunhide that you can use to include it in your boot process.
