diff options
| author | Nick Kralevich <nnk@google.com> | 2015-11-07 16:52:17 -0800 |
|---|---|---|
| committer | Nick Kralevich <nnk@google.com> | 2015-11-09 09:08:46 -0800 |
| commit | c39ba5ae32afb6329d42e61d2941d87ff66d92e3 (patch) | |
| tree | a5fca3ab71e1856a75e995c1d8ec81dc55bd56e1 /base/errors_unix.cpp | |
| parent | 54b5e85373619a838641d276a840caad284b09b3 (diff) | |
Enable hidepid=2 on /proc
Add the following mount options to the /proc filesystem:
hidepid=2,gid=3009
This change blocks /proc access unless you're in group 3009
(aka AID_READPROC).
Please see
https://github.com/torvalds/linux/blob/master/Documentation/filesystems/proc.txt
for documentation on the hidepid option.
hidepid=2 is preferred over hidepid=1 since it leaks less information
and doesn't generate SELinux ptrace denials when trying to access
/proc without being in the proper group.
Add AID_READPROC to processes which need to access /proc entries for
other UIDs.
Bug: 23310674
Change-Id: I22bb55ff7b80ff722945e224845215196f09dafa
Diffstat (limited to 'base/errors_unix.cpp')
0 files changed, 0 insertions, 0 deletions