Re: Debian-Harden
On Tue, May 15, 2001 at 10:52:44AM -0400, Michael Stone wrote:
> On Tue, May 15, 2001 at 08:43:33AM +0200, bounce-debian-devel=mstone=cs.loyola.edu@lists.debian.org wrote:
> > There are some commands on System, which are similar useable for root and
> > user. Think of ps, everyone on an linux-system is able to run "ps aux", so
> > it is shown all processes of the host.
> > I think, it it fully enaough, to let an user only make ps -a", for example,
> > to see the own processes.
>
> That level of information hiding is out of scope for a general unix
> system.
Some Other unixen restrict users **in the kernel** to only view info on
their own processes, unless root id.
Which means ps is a setuid root executable, to allow viewing all processes.
If it isnt setuid, users cant view that info any more.
I would think changing the owner/perms on the pid area of /proc should be a
relatively straightforward kernel hack.
Reply to: