Process hiding in LXC (hidepid proc mount option)

[fabian]

it seems like this is broken either generally or in our specific combination of AppArmor userspace + kernel.. adding FS specific options to a mount rule should work according to the doc, but the parser chokes on it.

 

[onlime]

Hi @fabian
Thanks for your feedback. Definitely looks like something is broken here. Are you aware of anybody working on it or are you going to look into it by yourself in more detail?
Best regards,
Philip

 

[fabian]

Hi @fabian
Thanks for your feedback. Definitely looks like something is broken here. Are you aware of anybody working on it or are you going to look into it by yourself in more detail?

filing an issue on our bugzilla and testing with e.g. a stock Ubuntu 17.10 or 18.04 would be helpful - if it is broken there as well we can take it upstream.

 

[onlime]

filed the issue here:

Bug 1730 - Process hiding in container (hidepid proc mount option) no longer works since LXC 2.1

no response yet. Thanks a lot for taking this upstream!

 

[Meidei]

Hi Community

I have exactly the same problem with hidepid. I am running on kernel 4.15.17-3-pve and it is still not supported.

I also always get:
$ mount -o remount,hidepid=2 /proc
mount: cannot remount proc read-write, is write-protected

Does anyone has a hint on this topic? Because it is a big security issue for me.