Changing kernel function permissions?

juanbobo · 11-26-2005, 01:34 PM

What would it take to change the permissions of the core kernel functions? For example, I don't want users to be able to see what processes are running or open network connections. You can change the permissions of ps and netstat, but it is still possible for users to write programs to request the same information from the kernel. Is there any way to prevent this without rewriting the kernel?

trickykid · 11-27-2005, 10:37 AM

What would be the whole reason behind this? If you've setup your host correctly, you shouldn't have to worry about regular users who can view processes running. If I were a user that had access to a host, if one of my applications was hung or not, it would be rather handy to see the process running, get the id of it, so I could kill it, restart it, etc.

I fail to see the reasoning behind what your wanting to accomplish.

juanbobo · 11-29-2005, 08:58 PM

I want to be able to control which kernel functions are accessible by users.

btmiller · 11-29-2005, 09:06 PM

Look into something like grsecurity or SELinux. Neither are exactly trivial to set up with a custom configuration, though. I suppose you could also not mount /proc so people couldn't read any of the files in there, but it would undoubtedly break some stuff. Beyond that, you might have to get into some custom kernel hacking.