Hi, short question. Is it possible to configure following scenario.

System user "Mike" executing following command: ps -Af

...and he see also processess from other users. Is it possible to block processess from other users ? To hide ?

greetz

Dlugi

If "man ps" doesn't work and you can't install the man pages to make it work, there's always "man ps" in the Google search box.

To my knowledge, you can only hide processes by running the user sessions i a container. IT can be an lxc container, or an OpenVZ guest, but basically amounts to a virtual machine that is protected from knowing very much about the host.

Searching LQ would have shown that GRSecurity has had that type of privilege separation for ages.

Is it also possible to chroot SSH user ?

dlugasx,
Yes, you can chroot an SSH user. There are already some threads about that here on LQ.

Chrooting alone will not prevent users from seeing the full process list.
Some kind of containerization that allows a user to ONLY see their OWN processes will, or true virtualization.
I am unfamiliar with other solutions, but a kernel module crafted to hide processes might do. I understand some rootkits have that capability.

...also see the (ancient but still valid) "How to break out of a chroot jail" text.


Rootkit LKMs usually isolate specific processes, being the reverse of the isolation type the OP asked for. Running a rootkit LKM for that purpose seems a rather odd choice (I do hope you're not seriously suggesting people run one) as mature, supported and maintained solutions exist.

I would never suggest that ANYONE run a rootkit for any reason other than security experimentation and a platform built for that express purpose.

If I may expound a bit: Reading and understanding the CODE from a rootkit that hides certain process from examination using the standard tools might be instructive. Unless one is an experienced and accomplished system level programmer or kernel hacker, it is likely to be wasted effort, but if one qualifies it could be one interesting avenue for investigation.

Forgive me for not making my meaning clear.

PLEASE do not run a rootkit on your system! If you do, I DID NOT TELL YOU TO!!!