Process hiding in LXC (hidepid proc mount option)

it seems like this is broken either generally or in our specific combination of AppArmor userspace + kernel.. adding FS specific options to a mount rule should work according to the doc, but the parser chokes on it.
 
onlime said:
Hi @fabian
Thanks for your feedback. Definitely looks like something is broken here. Are you aware of anybody working on it or are you going to look into it by yourself in more detail?
Click to expand...

filing an issue on our bugzilla and testing with e.g. a stock Ubuntu 17.10 or 18.04 would be helpful - if it is broken there as well we can take it upstream.
 
Hi Community

I have exactly the same problem with hidepid. I am running on kernel 4.15.17-3-pve and it is still not supported.

I also always get:
$ mount -o remount,hidepid=2 /proc
mount: cannot remount proc read-write, is write-protected

Does anyone has a hint on this topic? Because it is a big security issue for me.
 
You must log in or register to reply here.
Top Bottom