Editing
Secure ProcFS Entries
From Linix VServer
Jump to navigation
Jump to search
Warning:
You are not logged in. Your IP address will be publicly visible if you make any edits. If you
log in
or
create an account
, your edits will be attributed to your username, along with other benefits.
Anti-spam check. Do
not
fill this in!
<div id="content"> <span id="top"></span> <span id="firstHeading"></span> = Secure ProcFS Entries = <div id="bodyContent"> <span id="siteSub"></span> === From Linux-VServer === <div id="contentSub"> </div> <div id="jump-to-nav"> Jump to: [[#column-one|navigation]], [[#searchInput|search]] </div> <div id="mw-content-text" class="mw-content-ltr" dir="ltr" lang="en"> <div class="LanguageLinks"> {| class="wikitable" style="clear: both; border-collapse: collapse; padding: 0; margin: 0; font-size: 85%;" width="100%" |- style="background: #ffffff" valign="top" | style="padding: 1px 1em 0; background: #ffffff"| '''English''' • [[index.php?title=Secure_ProcFS_Entries/de&action=edit&redlink=1|Deutsch]] • [[index.php?title=Secure_ProcFS_Entries/es&action=edit&redlink=1|español]] • [[Secure_ProcFS_Entries/fr|français]] • |} </div> <br /> The Linux-VServer project provides a mechanism to protect entries in the proc filesystem from being seen in every context, this has been introduced in development release 1.3.5 and stable release 1.23. The system consists of three flags: admin, watch and hide. To view/set these, a recent version of the util-vserver package, containing setattr and showattr, is required. (There is another tool called vproc, but this won't be discussed here). The logic behind these flags has been changed in experimental release 0.09, and new devel / stable releases that also use this logic, are coming soon, so the old logic won't be explained here (if you're running an older version of Linux-VServer, you probably already figured it out yourself anyways). '''Note:''' When referring to the flags, I'll follow the syntax used by the showattr tool of the util-vserver package, where '''a''' means admin, '''w''' means watch and '''h''' means hide, also lower case means disabled and upper case means enabled. {| id="toc" class="wikitable toc" |- | <div id="toctitle"> <span id="contents"></span> == Contents == </div> * [[#Flag_logic_.28Linux-VServer_2.4_branch_.3E_1.3.7_.2F_2.6_branch_.3E_0.08.29|<span class="tocnumber">1</span> <span class="toctext">Flag logic (Linux-VServer 2.4 branch > 1.3.7 / 2.6 branch > 0.08)</span>]] * [[#Default_flagging|<span class="tocnumber">2</span> <span class="toctext">Default flagging</span>]] * [[#Setting_flags|<span class="tocnumber">3</span> <span class="toctext">Setting flags</span>]] * [[#vprocunhide|<span class="tocnumber">4</span> <span class="toctext">vprocunhide</span>]] |} <span id="flag-logic-linux-vserver-2.4-branch-1.3.7-2.6-branch-0.08"></span> == <span id="Flag_logic_.28Linux-VServer_2.4_branch_.3E_1.3.7_.2F_2.6_branch_.3E_0.08.29" class="mw-headline"> Flag logic (Linux-VServer 2.4 branch > 1.3.7 / 2.6 branch > 0.08) </span> == The flags have the following meanings: {| class="wikitable wikitablenowrap" |- ! Flag ! Meaning |- | admin | always visible in context 0 |- | watch | always visible in context 1 |- | hide | hidden |} This means a mapping of flagging to visibility according to this table: {| class="wikitable wikitablenowrap" |- ! Flags ! Visibility |- | <code>* * h</code> | Visible everwhere (admin and watch flags don't matter) |- | <code>A w H</code> | Visible only in context 0 |- | <code>a W H </code> | Visible only in context 1 |- | <code>A W H </code> | Visible in contexts 0 and 1 |- | <code>a w H</code> | Totally invisible (cannot be reverted without rebooting!) |} <span id="default-flagging"></span> == <span id="Default_flagging" class="mw-headline"> Default flagging </span> == As of now the stable vs1.2.x (2.4 kernel defaults to all proc entries visible everywhere, stable vs2.0.x (2.6 kernel), development and experimental versions default to all proc entries only visible in context 0 and 1. <span id="setting-flags"></span> == <span id="Setting_flags" class="mw-headline">Setting flags</span> == To set those flags you'll need the setattr tool from a recent util-vserver package (0.30.193 works), the usage is pretty much self-explanatory from the command-line help. To make the /proc/loadavg entry visible everywhere, you have to unset the hide flag: <pre>setattr --~hide /proc/loadavg</pre> The admin and watch flag can be in any state as hiding is controlled by the hide flag only. To keep vservers from reading the interrupt information, you need to hide the /proc/interrupts entry. If you want this to be accessible in the admin context (0) only use: <pre>setattr --hide --admin --~watch /proc/interrupts</pre> <span id="vprocunhide"></span> == <span id="vprocunhide" class="mw-headline">vprocunhide </span> == With alpha util-vserver comes a tool called vprocunhide that sets reasonable flags for a number of proc entries that are generally needed to be visible. There is also an init script, normally located at /usr/local/etc/init.d/vprocunhide that you can use to include it in your boot process. </div> <div class="printfooter"> Retrieved from "http://wiki.linux-vserver.org/index.php?title=Secure_ProcFS_Entries&oldid=5066" </div> <div id="catlinks" class="catlinks"> <div id="mw-normal-catlinks" class="mw-normal-catlinks"> [[Special:Categories|Category]]: * [[Category:ProcFS|ProcFS]] </div> </div> <div class="visualClear"> </div> </div> </div>
Summary:
Please note that all contributions to Linix VServer may be edited, altered, or removed by other contributors. If you do not want your writing to be edited mercilessly, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource (see
Linix VServer:Copyrights
for details).
Do not submit copyrighted work without permission!
Cancel
Editing help
(opens in new window)
Navigation menu
Page actions
Page
Discussion
Read
Edit
History
Page actions
Page
Discussion
More
Tools
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
About
Overview
Paper
News
Developers
Donations
Search
Getting Started
Downloads
FAQs
Documentation
Support
Participate
How to participate
Report a Bug
Communicate
Teams/Projects
Hall of Fame
Resources
Archives
Recent Wiki Changes
Pastebin
Related Projects
VServer Hosting
Happy VServer Users
Tools
What links here
Related changes
Special pages
Page information