Red Hat Bugzilla – Bug 1069255
[RFE] easy way to mount /proc with hidepid=1
Last modified: 2014-07-02 13:55:49 EDT
Description of problem: I stumbled across the proc mount option 'hidepid' and realized that hidepid=1 is something I should run on my shared server. While it doesn't take the place of my other system security, it feels like the right call. It seems with RHEL7 that systemd is mounting /proc for me. However, I can't seem to find the approprate unit file to add overrides. Version-Release number of selected component (if applicable):systemd-207-8.el7.x86_64 How reproducible:100% Steps to Reproduce: 1.seek to change mount options of /proc/ 2.not listed in /etc/fstab 3.not listed in systemctl list-uints Actual results: no clear way to change mount options of /proc/ Expected results: a clear way to change the mount options of /proc/ Additional info:
This request was not resolved in time for the current release. Red Hat invites you to ask your support representative to propose this request, if still desired, for consideration in the next release of Red Hat Enterprise Linux.
afaik proc mount options can't be really altered without patching src/core/mount-setup.c. However nothing prevents you from adding explicit entry to fstab, e.g. proc /proc proc defaults,hidepid=1 0 0 systemd will initially mount /proc with options which are hard-coded. But during boot-up service systemd-remount-fs.service is invoked which goes through /etc/fstab and remount *all* API file-systems (proc included of course) with desired options which might have not been applied by systemd at first. Hence adding above entry to fstab is preferred solution for this issue.