Bug 1069255 - [RFE] easy way to mount /proc with hidepid=1
Summary: [RFE] easy way to mount /proc with hidepid=1
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: systemd
Version: 7.0
Hardware: All
OS: Linux
Target Milestone: rc
: ---
Assignee: systemd-maint
QA Contact: qe-baseos-daemons
Depends On:
TreeView+ depends on / blocked
Reported: 2014-02-24 15:20 UTC by Pat Riehecky
Modified: 2014-07-02 17:55 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
Clone Of:
Last Closed: 2014-07-02 17:55:49 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description Pat Riehecky 2014-02-24 15:20:42 UTC
Description of problem: I stumbled across the proc mount option 'hidepid' and realized that hidepid=1 is something I should run on my shared server.  While it doesn't take the place of my other system security, it feels like the right call.

It seems with RHEL7 that systemd is mounting /proc for me.  However, I can't seem to find the approprate unit file to add overrides.

Version-Release number of selected component (if applicable):systemd-207-8.el7.x86_64

How reproducible:100%

Steps to Reproduce:
1.seek to change mount options of /proc/
2.not listed in /etc/fstab
3.not listed in systemctl list-uints

Actual results:
no clear way to change mount options of /proc/

Expected results:
a clear way to change the mount options of /proc/

Additional info:

Comment 2 RHEL Program Management 2014-03-22 05:57:43 UTC
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

Comment 3 Michal Sekletar 2014-07-02 17:55:49 UTC
afaik proc mount options can't be really altered without patching src/core/mount-setup.c. However nothing prevents you from adding explicit entry to fstab, e.g.

proc   /proc    proc   defaults,hidepid=1   0   0

systemd will initially mount /proc with options which are hard-coded. But during boot-up service systemd-remount-fs.service is invoked which goes through /etc/fstab and remount *all* API file-systems (proc included of course) with desired options which might have not been applied by systemd at first. Hence adding above entry to fstab is preferred solution for this issue.

Note You need to log in before you can comment on or make changes to this bug.