Bug 1069255

Summary: [RFE] easy way to mount /proc with hidepid=1
Product: Red Hat Enterprise Linux 7 Reporter: Pat Riehecky <riehecky>
Component: systemdAssignee: systemd-maint
Status: CLOSED NOTABUG QA Contact: qe-baseos-daemons
Severity: low Docs Contact:
Priority: unspecified    
Version: 7.0CC: msekleta, systemd-maint-list
Target Milestone: rcKeywords: FutureFeature
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-07-02 17:55:49 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Pat Riehecky 2014-02-24 15:20:42 UTC
Description of problem: I stumbled across the proc mount option 'hidepid' and realized that hidepid=1 is something I should run on my shared server.  While it doesn't take the place of my other system security, it feels like the right call.

It seems with RHEL7 that systemd is mounting /proc for me.  However, I can't seem to find the approprate unit file to add overrides.

Version-Release number of selected component (if applicable):systemd-207-8.el7.x86_64

How reproducible:100%

Steps to Reproduce:
1.seek to change mount options of /proc/
2.not listed in /etc/fstab
3.not listed in systemctl list-uints

Actual results:
no clear way to change mount options of /proc/

Expected results:
a clear way to change the mount options of /proc/

Additional info:

Comment 2 RHEL Product and Program Management 2014-03-22 05:57:43 UTC
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

Comment 3 Michal Sekletar 2014-07-02 17:55:49 UTC
afaik proc mount options can't be really altered without patching src/core/mount-setup.c. However nothing prevents you from adding explicit entry to fstab, e.g.

proc   /proc    proc   defaults,hidepid=1   0   0

systemd will initially mount /proc with options which are hard-coded. But during boot-up service systemd-remount-fs.service is invoked which goes through /etc/fstab and remount *all* API file-systems (proc included of course) with desired options which might have not been applied by systemd at first. Hence adding above entry to fstab is preferred solution for this issue.