/proc hidepid setting ignored at boot

The_Dark_Passenger · 09-27-2019, 02:21 AM

Hello,

I am trying to set the hidepid value to 2 for /proc at boot. This is how the proc entry appears in my /etc/fstab.

Code:

proc             /proc            proc        defaults,hidepid=2      0   0

However, it is not set at boot, and instead it just uses the default mount options. Remounting /proc with hidepid=2 works. It just won't set at boot. I have also tried setting rw,relatime,hidepid=2 instead of defaults, but that doesn't work either.

Running most up to date Slackware64 -current with 4.19.75 generic kernel.

Any help would be appreciated as to why this isn't occurring at boot.

Thanks!

ehartman · 09-27-2019, 02:49 AM

Quote:

Originally Posted by The_Dark_Passenger

Any help would be appreciated as to why this isn't occurring at boot.

/proc isn't mounted through the fstab entry, just like /dev/root it is accessed by the kernel much earlier in the boot process. In fact /proc and /sys do not need fstab entries at all as they're auto-mounted anyway. My system doesn't have any entries for either /proc or /sys and still "mount" shows them as mounted, before any of the /etc/fstab entries are shown (like usbfs, which is mounted below /proc):

Quote:

/dev/sda1 on / type ext3 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
usbfs on /proc/bus/usb type usbfs (rw,devmode=0666)

An optional fstab entry will - just as for the root fs - only be used when you use a "remount" command, i.e. in rc.local

PS: that the root is shown as /dev/sda1 is because of a remount in the rc.S script

Quote:

# Remount the root filesystem in read-write mode
echo "Remounting root device with read-write enabled."
/sbin/mount -w -v -n -o remount /

because now udev is active, so all devices have been created.

syg00 · 09-27-2019, 03:37 AM

I don't use slack these days, but check the initrd for a proc mount.

abga · 09-28-2019, 01:13 PM

@The_Dark_Passenger

AFAIK there's no kernel boot parameter to influence the way /proc is mounted and you need to remount it if you want to change the mount options. You could either remount it automatically at boot time with the help of the rc init scripts (/etc/rc.d/rc.local would be more appropriate(clean/non-invasive)) and add your hidepid=2 , or, you can prepare an initrd.img and add your special mount option there, as suggested here:
https://unix.stackexchange.com/quest...tently-at-boot

pyllyukko · 04-02-2020, 05:33 AM

In Slackware 14.2 I have the following in /etc/rc.d/rc.S:

Code:

/sbin/mount -v proc /proc -n -t proc -o hidepid=2 2> /dev/null

And it does just that. Users can only see their own processes. All is well!

Now when I try to accomplish the same with Slackware64 current, it just doesn't seem to work no matter what I try

mumahendras3 · 04-02-2020, 08:54 AM

Quote:

Originally Posted by pyllyukko

In Slackware 14.2 I have the following in /etc/rc.d/rc.S:

Code:

/sbin/mount -v proc /proc -n -t proc -o hidepid=2 2> /dev/null

And it does just that. Users can only see their own processes. All is well!

Now when I try to accomplish the same with Slackware64 current, it just doesn't seem to work no matter what I try

Do you use initrd? The init script inside initrd mounted the /proc early before switching to the real root. Try modifying that script (check inside your initrd-tree directory, which by default is /boot/initrd-tree).

pyllyukko · 04-03-2020, 04:54 AM

Quote:

Originally Posted by mumahendras3

Do you use initrd? The init script inside initrd mounted the /proc early before switching to the real root. Try modifying that script (check inside your initrd-tree directory, which by default is /boot/initrd-tree).

It happens with and without initrd. I also tried modifying the initrd image and it still didn't work.

pyllyukko · 12-24-2020, 04:06 AM

I solved this. So I noticed that when you check mounts there is a double entry for /proc:

Code:

$ mount|grep proc
proc on /proc type proc (rw,relatime,gid=87,hidepid=invisible)
proc on /proc type proc (rw,relatime,gid=87,hidepid=invisible)

I set hidepid in both the initrd image and rc.S and now the processes are hidden. You can see the details in this commit.