Bug 1069255 - [RFE] easy way to mount /proc with hidepid=1
[RFE] easy way to mount /proc with hidepid=1
Status: CLOSED NOTABUG
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: systemd (Show other bugs)
7.0
All Linux
unspecified Severity low
: rc
: ---
Assigned To: systemd-maint
qe-baseos-daemons
: FutureFeature
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2014-02-24 10:20 EST by Pat Riehecky
Modified: 2014-07-02 13:55 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-07-02 13:55:49 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Pat Riehecky 2014-02-24 10:20:42 EST
Description of problem: I stumbled across the proc mount option 'hidepid' and realized that hidepid=1 is something I should run on my shared server.  While it doesn't take the place of my other system security, it feels like the right call.

It seems with RHEL7 that systemd is mounting /proc for me.  However, I can't seem to find the approprate unit file to add overrides.


Version-Release number of selected component (if applicable):systemd-207-8.el7.x86_64


How reproducible:100%


Steps to Reproduce:
1.seek to change mount options of /proc/
2.not listed in /etc/fstab
3.not listed in systemctl list-uints

Actual results:
no clear way to change mount options of /proc/

Expected results:
a clear way to change the mount options of /proc/

Additional info:
Comment 2 RHEL Product and Program Management 2014-03-22 01:57:43 EDT
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 3 Michal Sekletar 2014-07-02 13:55:49 EDT
afaik proc mount options can't be really altered without patching src/core/mount-setup.c. However nothing prevents you from adding explicit entry to fstab, e.g.

proc   /proc    proc   defaults,hidepid=1   0   0

systemd will initially mount /proc with options which are hard-coded. But during boot-up service systemd-remount-fs.service is invoked which goes through /etc/fstab and remount *all* API file-systems (proc included of course) with desired options which might have not been applied by systemd at first. Hence adding above entry to fstab is preferred solution for this issue.

Note You need to log in before you can comment on or make changes to this bug.