Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 10 Feb 2020 16:05:18 +0100
From: Alexey Gladkov <>
To: LKML <>,
	Kernel Hardening <>,
	Linux API <>,
	Linux FS Devel <>,
	Linux Security Module <>
Cc: Akinobu Mita <>,
	Alexander Viro <>,
	Alexey Dobriyan <>,
	Alexey Gladkov <>,
	Andrew Morton <>,
	Andy Lutomirski <>,
	Daniel Micay <>,
	Djalal Harouni <>,
	"Dmitry V . Levin" <>,
	"Eric W . Biederman" <>,
	Greg Kroah-Hartman <>,
	Ingo Molnar <>,
	"J . Bruce Fields" <>,
	Jeff Layton <>,
	Jonathan Corbet <>,
	Kees Cook <>,
	Linus Torvalds <>,
	Oleg Nesterov <>,
	Solar Designer <>
Subject: [PATCH v8 10/11] docs: proc: add documentation for "hidepid=4" and "subset=pidfs" options and new mount behavior

Signed-off-by: Alexey Gladkov <>
 Documentation/filesystems/proc.txt | 53 ++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/Documentation/filesystems/proc.txt b/Documentation/filesystems/proc.txt
index 99ca040e3f90..4741fd092f36 100644
--- a/Documentation/filesystems/proc.txt
+++ b/Documentation/filesystems/proc.txt
@@ -50,6 +50,8 @@ Table of Contents
   4	Configuring procfs
   4.1	Mount options
+  5	Filesystem behavior
@@ -2021,6 +2023,7 @@ The following mount options are supported:
 	hidepid=	Set /proc/<pid>/ access mode.
 	gid=		Set the group authorized to learn processes information.
+	subset=		Show only the specified subset of procfs.
 hidepid=0 means classic mode - everybody may access all /proc/<pid>/ directories
@@ -2042,6 +2045,56 @@ information about running processes, whether some daemon runs with elevated
 privileges, whether other user runs some sensitive program, whether other users
 run any program at all, etc.
+hidepid=4 means that procfs should only contain /proc/<pid>/ directories
+that the caller can ptrace.
 gid= defines a group authorized to learn processes information otherwise
 prohibited by hidepid=.  If you use some daemon like identd which needs to learn
 information about processes information, just add identd to this group.
+subset=pidfs hides all top level files and directories in the procfs that
+are not related to tasks.
+5 Filesystem behavior
+Originally, before the advent of pid namepsace, procfs was a global file
+system. It means that there was only one procfs instance in the system.
+When pid namespace was added, a separate procfs instance was mounted in
+each pid namespace. So, procfs mount options are global among all
+mountpoints within the same namespace.
+# grep ^proc /proc/mounts
+proc /proc proc rw,relatime,hidepid=2 0 0
+# strace -e mount mount -o hidepid=1 -t proc proc /tmp/proc
+mount("proc", "/tmp/proc", "proc", 0, "hidepid=1") = 0
++++ exited with 0 +++
+# grep ^proc /proc/mounts
+proc /proc proc rw,relatime,hidepid=2 0 0
+proc /tmp/proc proc rw,relatime,hidepid=2 0 0
+and only after remounting procfs mount options will change at all
+# mount -o remount,hidepid=1 -t proc proc /tmp/proc
+# grep ^proc /proc/mounts
+proc /proc proc rw,relatime,hidepid=1 0 0
+proc /tmp/proc proc rw,relatime,hidepid=1 0 0
+This behavior is different from the behavior of other filesystems.
+The new procfs behavior is more like other filesystems. Each procfs mount
+creates a new procfs instance. Mount options affect own procfs instance.
+It means that it became possible to have several procfs instances
+displaying tasks with different filtering options in one pid namespace.
+# mount -o hidepid=2 -t proc proc /proc
+# mount -o hidepid=1 -t proc proc /tmp/proc
+# grep ^proc /proc/mounts
+proc /proc proc rw,relatime,hidepid=2 0 0
+proc /tmp/proc proc rw,relatime,hidepid=1 0 0

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.