Command to mount /proc with subset=pid

[rusty-snake]

Is your feature request related to a problem? Please describe.

System information exposed in various proc files such as cmdline, kallsyms, ... can contain sensitive information. A lot of programs work w/o them.

Describe the solution you'd like

Mount proc with subset=pid. On older kernels were subset=pid isn't supported we should ignore it if it was requested in a profile an proceed without it; if it was requested on the cli, we should harderror.

This need to be opt-in so suggestions for the command name are welcome (for crabjail I currently use the bulky fs._proc-exposes-system-information to turn it off and --mount-proc-subset=pid in crablock to turn it on, systemd uses ProcSubset=pid to turn it on).

Describe alternatives you've considered

We have disable-proc.inc, but enumerating badness does not work as good as subset=pid does.
Also some programs fail on EACCES but have fallback for ENOENT.

Downside: subset=pid is all or nothing. You can not mkdir/mknod in proc and bind something on it.

Additional context

Previous discussions:

• Whitelist2 #4229 (comment)
• Whitelisting on /proc #6489

[rusty-snake]

$ crablock --mount-proc --mount-proc-subset= -- ls /proc
1	    diskstats	   keys		  mounts	swaps
2	    dma		   key-users	  mtd		sys
acpi	    driver	   kmsg		  mtrr		sysrq-trigger
asound	    dynamic_debug  kpagecgroup	  net		sysvipc
bootconfig  execdomains    kpagecount	  pagetypeinfo	thread-self
buddyinfo   filesystems    kpageflags	  partitions	timer_list
bus	    fs		   latency_stats  pressure	tty
cgroups     interrupts	   loadavg	  schedstat	uptime
cmdline     iomem	   locks	  scsi		version
consoles    ioports	   mdstat	  self		vmallocinfo
cpuinfo     irq		   meminfo	  slabinfo	vmstat
crypto	    kallsyms	   misc		  softirqs	zoneinfo
devices     kcore	   modules	  stat
$ crablock --mount-proc --mount-proc-subset=pid -- ls /proc
1  2  self  thread-self

[kmk3]

+1

It would be nice to have a command for hidepid=n as well.

[rusty-snake]

While it would be a nice to have, it us not very useful because of the unshared pid namespace. So you need processes with different uids running in the sandbox.