Secure ProcFS Entries: Difference between revisions
imported>Glenn (catchg) |
(Restored content from Wayback Machine) |
||
| Line 1: | Line 1: | ||
<div id="content"> | |||
The Linux-VServer project provides a mechanism to protect entries in the proc filesystem from being seen in every context, this has been introduced in development release 1.3.5 and stable release 1.23. | <span id="top"></span> | ||
<span id="firstHeading"></span> | |||
= Secure ProcFS Entries = | |||
<div id="bodyContent"> | |||
<span id="siteSub"></span> | |||
=== From Linux-VServer === | |||
<div id="contentSub"> | |||
</div> | |||
<div id="jump-to-nav"> | |||
Jump to: [[#column-one|navigation]], [[#searchInput|search]] | |||
</div> | |||
<div id="mw-content-text" class="mw-content-ltr" dir="ltr" lang="en"> | |||
<div class="LanguageLinks"> | |||
{| class="wikitable" style="clear: both; border-collapse: collapse; padding: 0; margin: 0; font-size: 85%;" width="100%" | |||
|- style="background: #ffffff" valign="top" | |||
| style="padding: 1px 1em 0; background: #ffffff"| '''English''' • [[index.php?title=Secure_ProcFS_Entries/de&action=edit&redlink=1|Deutsch]] • [[index.php?title=Secure_ProcFS_Entries/es&action=edit&redlink=1|español]] • [[Secure_ProcFS_Entries/fr|français]] • | |||
|} | |||
</div> | |||
<br /> | |||
The Linux-VServer project provides a mechanism to protect entries in the proc filesystem from being seen in every context, this has been introduced in development release 1.3.5 and stable release 1.23. | |||
The system consists of three flags: admin, watch and hide. To view/set these, a recent version of the util-vserver package, containing setattr and showattr, is required. (There is another tool called vproc, but this won't be discussed here). The logic behind these flags has been changed in experimental release 0.09, and new devel / stable releases that also use this logic, are coming soon, so the old logic won't be explained here (if you're running an older version of Linux-VServer, you probably already figured it out yourself anyways). | The system consists of three flags: admin, watch and hide. To view/set these, a recent version of the util-vserver package, containing setattr and showattr, is required. (There is another tool called vproc, but this won't be discussed here). The logic behind these flags has been changed in experimental release 0.09, and new devel / stable releases that also use this logic, are coming soon, so the old logic won't be explained here (if you're running an older version of Linux-VServer, you probably already figured it out yourself anyways). | ||
| Line 7: | Line 39: | ||
'''Note:''' When referring to the flags, I'll follow the syntax used by the showattr tool of the util-vserver package, where '''a''' means admin, '''w''' means watch and '''h''' means hide, also lower case means disabled and upper case means enabled. | '''Note:''' When referring to the flags, I'll follow the syntax used by the showattr tool of the util-vserver package, where '''a''' means admin, '''w''' means watch and '''h''' means hide, also lower case means disabled and upper case means enabled. | ||
== Flag logic (Linux-VServer 2.4 branch > 1.3.7 / 2.6 branch | {| id="toc" class="wikitable toc" | ||
|- | |||
| <div id="toctitle"> | |||
<span id="contents"></span> | |||
== Contents == | |||
</div> | |||
* [[#Flag_logic_.28Linux-VServer_2.4_branch_.3E_1.3.7_.2F_2.6_branch_.3E_0.08.29|<span class="tocnumber">1</span> <span class="toctext">Flag logic (Linux-VServer 2.4 branch > 1.3.7 / 2.6 branch > 0.08)</span>]] | |||
* [[#Default_flagging|<span class="tocnumber">2</span> <span class="toctext">Default flagging</span>]] | |||
* [[#Setting_flags|<span class="tocnumber">3</span> <span class="toctext">Setting flags</span>]] | |||
* [[#vprocunhide|<span class="tocnumber">4</span> <span class="toctext">vprocunhide</span>]] | |||
|} | |||
<span id="flag-logic-linux-vserver-2.4-branch-1.3.7-2.6-branch-0.08"></span> | |||
== <span id="Flag_logic_.28Linux-VServer_2.4_branch_.3E_1.3.7_.2F_2.6_branch_.3E_0.08.29" class="mw-headline"> Flag logic (Linux-VServer 2.4 branch > 1.3.7 / 2.6 branch > 0.08) </span> == | |||
The flags have the following meanings: | The flags have the following meanings: | ||
{|class="wikitablenowrap" | |||
!Flag | {| class="wikitable wikitablenowrap" | ||
!Meaning | |- | ||
! Flag | |||
! Meaning | |||
|- | |- | ||
|admin | | admin | ||
| | | always visible in context 0 | ||
|- | |- | ||
|watch | | watch | ||
| | | always visible in context 1 | ||
|- | |- | ||
|hide | | hide | ||
| | | hidden | ||
|} | |} | ||
This means a mapping of flagging to visibility according to this table: | This means a mapping of flagging to visibility according to this table: | ||
{|class="wikitablenowrap" | |||
{| class="wikitable wikitablenowrap" | |||
|- | |- | ||
! Flags | |||
! Visibility | |||
|- | |- | ||
|< | | <code>* * h</code> | ||
|Visible | | Visible everwhere (admin and watch flags don't matter) | ||
|- | |- | ||
|< | | <code>A w H</code> | ||
|Visible only in context | | Visible only in context 0 | ||
|- | |- | ||
|< | | <code>a W H </code> | ||
|Visible in | | Visible only in context 1 | ||
|- | |- | ||
|< | | <code>A W H </code> | ||
|Totally invisible (cannot be reverted without rebooting!) | | Visible in contexts 0 and 1 | ||
|- | |||
| <code>a w H</code> | |||
| Totally invisible (cannot be reverted without rebooting!) | |||
|} | |} | ||
== Default flagging == | <span id="default-flagging"></span> | ||
== <span id="Default_flagging" class="mw-headline"> Default flagging </span> == | |||
As of now the stable vs1.2.x (2.4 kernel defaults to all proc entries visible everywhere, stable vs2.0.x (2.6 kernel), development and experimental versions default to all proc entries only visible in context 0 and 1. | As of now the stable vs1.2.x (2.4 kernel defaults to all proc entries visible everywhere, stable vs2.0.x (2.6 kernel), development and experimental versions default to all proc entries only visible in context 0 and 1. | ||
==Setting flags== | <span id="setting-flags"></span> | ||
== <span id="Setting_flags" class="mw-headline">Setting flags</span> == | |||
To set those flags you'll need the setattr tool from a recent util-vserver package (0.30.193 works), the usage is pretty much self-explanatory from the command-line help. To make the /proc/loadavg entry visible everywhere, you have to unset the hide flag: | To set those flags you'll need the setattr tool from a recent util-vserver package (0.30.193 works), the usage is pretty much self-explanatory from the command-line help. To make the /proc/loadavg entry visible everywhere, you have to unset the hide flag: | ||
<pre>setattr --~hide /proc/loadavg</pre> | |||
The admin and watch flag can be in any state as hiding is controlled by the hide flag only. | The admin and watch flag can be in any state as hiding is controlled by the hide flag only. | ||
To keep vservers from reading the interrupt information, you need to hide the /proc/interrupts entry. If you want this to be accessible in the admin context (0) only use: | To keep vservers from reading the interrupt information, you need to hide the /proc/interrupts entry. If you want this to be accessible in the admin context (0) only use: | ||
==vprocunhide == | <pre>setattr --hide --admin --~watch /proc/interrupts</pre> | ||
<span id="vprocunhide"></span> | |||
== <span id="vprocunhide" class="mw-headline">vprocunhide </span> == | |||
With alpha util-vserver comes a tool called vprocunhide that sets reasonable flags for a number of proc entries that are generally needed to be visible. There is also an init script, normally located at /usr/local/etc/init.d/vprocunhide that you can use to include it in your boot process. | With alpha util-vserver comes a tool called vprocunhide that sets reasonable flags for a number of proc entries that are generally needed to be visible. There is also an init script, normally located at /usr/local/etc/init.d/vprocunhide that you can use to include it in your boot process. | ||
[[Category:ProcFS]] | |||
</div> | |||
<div class="printfooter"> | |||
Retrieved from "http://wiki.linux-vserver.org/index.php?title=Secure_ProcFS_Entries&oldid=5066" | |||
</div> | |||
<div id="catlinks" class="catlinks"> | |||
<div id="mw-normal-catlinks" class="mw-normal-catlinks"> | |||
[[Special:Categories|Category]]: | |||
* [[Category:ProcFS|ProcFS]] | |||
</div> | |||
</div> | |||
<div class="visualClear"> | |||
</div> | |||
</div> | |||
</div> | |||
Latest revision as of 00:46, 11 November 2025
Secure ProcFS Entries[edit]
From Linux-VServer[edit]
The Linux-VServer project provides a mechanism to protect entries in the proc filesystem from being seen in every context, this has been introduced in development release 1.3.5 and stable release 1.23.
The system consists of three flags: admin, watch and hide. To view/set these, a recent version of the util-vserver package, containing setattr and showattr, is required. (There is another tool called vproc, but this won't be discussed here). The logic behind these flags has been changed in experimental release 0.09, and new devel / stable releases that also use this logic, are coming soon, so the old logic won't be explained here (if you're running an older version of Linux-VServer, you probably already figured it out yourself anyways).
Note: When referring to the flags, I'll follow the syntax used by the showattr tool of the util-vserver package, where a means admin, w means watch and h means hide, also lower case means disabled and upper case means enabled.
Contents[edit] |
Flag logic (Linux-VServer 2.4 branch > 1.3.7 / 2.6 branch > 0.08) [edit]
The flags have the following meanings:
| Flag | Meaning |
|---|---|
| admin | always visible in context 0 |
| watch | always visible in context 1 |
| hide | hidden |
This means a mapping of flagging to visibility according to this table:
| Flags | Visibility |
|---|---|
* * h
|
Visible everwhere (admin and watch flags don't matter) |
A w H
|
Visible only in context 0 |
a W H
|
Visible only in context 1 |
A W H
|
Visible in contexts 0 and 1 |
a w H
|
Totally invisible (cannot be reverted without rebooting!) |
Default flagging [edit]
As of now the stable vs1.2.x (2.4 kernel defaults to all proc entries visible everywhere, stable vs2.0.x (2.6 kernel), development and experimental versions default to all proc entries only visible in context 0 and 1.
Setting flags[edit]
To set those flags you'll need the setattr tool from a recent util-vserver package (0.30.193 works), the usage is pretty much self-explanatory from the command-line help. To make the /proc/loadavg entry visible everywhere, you have to unset the hide flag:
setattr --~hide /proc/loadavg
The admin and watch flag can be in any state as hiding is controlled by the hide flag only.
To keep vservers from reading the interrupt information, you need to hide the /proc/interrupts entry. If you want this to be accessible in the admin context (0) only use:
setattr --hide --admin --~watch /proc/interrupts
vprocunhide [edit]
With alpha util-vserver comes a tool called vprocunhide that sets reasonable flags for a number of proc entries that are generally needed to be visible. There is also an init script, normally located at /usr/local/etc/init.d/vprocunhide that you can use to include it in your boot process.