hiding /proc/<pid>/ entries for objects with the h flag?

Submit your RBAC policies or suggest policy improvements

hiding /proc/<pid>/ entries for objects with the h flag?

Postby cormander » Fri Mar 14, 2008 4:17 pm

One thing I noticed about the "h" flag is it doesn't hide the fact that the object is actually running.

For example, in my default policy, I have this:

Code: Select all
        /usr/sbin/sshd  h


But ps still reveals:

Code: Select all
root      1222  0.0  0.9  4096 1144 ?        Ss   Mar13   0:00 /usr/sbin/sshd


Now if I create a rule like this:

Code: Select all
        /proc/1222  h


Then ps won't see "/usr/sbin/sshd" in the tree, that is, until a restart of sshd (or a reboot).

Is there a way to either dynamically hide the /proc/<pid> of an object flagged for being hidden, or have an extra attribute for that?

Since the grsecurity kernel tracks execs of programs anyway, it could also (in theory) check for the h flag (or if you want to give this features a different flag) and dynamically load/unload the h flag for /proc/<pid> under subjects that aren't supposed to see that object.

Or maybe even make it a kernel .config option, similar to CONFIG_GRKERNSEC_ACL_HIDEKERN; named something like CONFIG_GRKERNSEC_ACL_HIDEFLAG_H
cormander
 
Posts: 154
Joined: Tue Jan 29, 2008 12:51 pm

Re: hiding /proc/<pid>/ entries for objects with the h flag?

Postby spender » Sun Mar 16, 2008 3:16 pm

"h" for objects is to hide the existence of the file. To hide the existence of a process, you need to create a subject (for sshd in your case) and add "h" to its subject mode. You likely already have a subject for sshd, so just append the "h" to the other subject flags for it.

-Brad
spender
 
Posts: 2185
Joined: Wed Feb 20, 2002 8:00 pm

Re: hiding /proc/<pid>/ entries for objects with the h flag?

Postby cormander » Mon Mar 17, 2008 10:36 am

Yes that works just as I had hoped. Thanks!
cormander
 
Posts: 154
Joined: Tue Jan 29, 2008 12:51 pm


Return to RBAC policy development

cron