Home / server / Questions / 211555
Accepted
pts
Asked: 2010-12-12 06:31:48 +0800 CST

Restricting /usr/bin/top to the current user with AppArmor

  • 772

Is it possible to restrict /usr/bin/top on Linux with AppArmor so it will display only the processes of the current user? In addition to that, /bin/ls /proc must not show any of the PIDs belonging to other users.

linux

3 Answers

  1. The only way to do this is to install a kernel patch. I recommend grSecurity. That will only show the users processes in a ps and should also limit it via top. If it doesn't the best thing to do in that case is

    chmod 700 /usr/bin/top

    So only root can run it. Most shell users would never even need top

    • 2
  2. Best Answer

    Short answer

    No, that is not something you can easily do with AppArmor. It is not hard to modify top and ls to do this, but bypassing these changes is trivial (roll your own ls and top). Modifying access to the /proc file system is likely to break many applications.

    Long answer

    Linux does not have this functionality built in as far as I know. You would have to modify the kernel to ensure that no system call can leak information about processes running for other users, but that's a large project. And the question remains... Why? If a user has shell access on your server the user can do lots of nasty things. If you want to restrict a user so he can not interact with the rest of the server you should put him into a container of some sort. Virtual machines are excellent for this.

    • 1

  3. This answer accomplishes the end OP had in mind, but not by the means they had in mind. The linux kernel (since 3.3) supports hiding processes from other users. To do this you will need to mount /proc with the hidepid option, to do this automatically at boot you will need to add a line like this in your /etc/fstab file

    proc /proc proc defaults,nosuid,nodev,noexec,relatime,hidepid=2 0 0

    run man proc for more info and to understand the hidepid numbers

    • 1