nixpkgs/nixos/modules/security
Joachim Fasting cef2814a4f nixos: add optional process information hiding
This module adds an option `security.hideProcessInformation` that, when
enabled, restricts access to process information such as command-line
arguments to the process owner.  The module adds a static group "proc"
whose members are exempt from process information hiding.

Ideally, this feature would be implemented by simply adding the
appropriate mount options to `fileSystems."/proc".fsOptions`, but this
was found to not work in vmtests. To ensure that process information
hiding is enforced, we use a systemd service unit that remounts `/proc`
after `systemd-remount-fs.service` has completed.

To verify the correctness of the feature, simple tests were added to
nixos/tests/misc: the test ensures that unprivileged users cannot see
process information owned by another user, while members of "proc" CAN.

Thanks to @abbradar for feedback and suggestions.
2016-04-10 12:27:06 +02:00
..
acme.nix simp_le: external_pem.sh plugin is now called external.sh 2016-02-26 01:31:58 +01:00
acme.xml nixos/acme: Add module documentation 2015-12-12 16:06:53 +01:00
apparmor-suid.nix Rewrite ‘with pkgs.lib’ -> ‘with lib’ 2014-04-14 16:26:48 +02:00
apparmor.nix nixos: add AppArmor PAM support 2015-07-15 12:40:06 +02:00
audit.nix audit: Disable in containers 2016-01-26 16:25:40 +01:00
ca.nix cacert: fix formatting of example 2016-02-27 22:25:39 +13:00
duosec.nix Fix user-facing typos (mainly in descriptions) 2014-12-30 03:31:03 +01:00
grsecurity.nix fix installer tests #13559 2016-03-12 20:19:40 +00:00
hidepid.nix nixos: add optional process information hiding 2016-04-10 12:27:06 +02:00
oath.nix config.security.oath: new module 2016-02-25 13:52:45 +00:00
pam_mount.nix pam_mount module: integrate pam_mount into PAM of NixOS 2015-07-04 23:42:31 +02:00
pam_usb.nix Rewrite ‘with pkgs.lib’ -> ‘with lib’ 2014-04-14 16:26:48 +02:00
pam.nix config.security.oath: new module 2016-02-25 13:52:45 +00:00
polkit.nix polkit: Remove unnecessary restart 2014-04-28 23:57:37 +02:00
prey.nix nixos: fix some types 2015-09-18 18:48:50 +00:00
rngd.nix nixos/rngd: some fixes 2015-01-06 17:27:07 +03:00
rtkit.nix rtkit: Update from 0.10 to 0.11 2014-04-21 23:22:10 +02:00
setuid-wrapper.c setuid-wrapper: Fix broken string comparison 2014-04-19 10:58:30 +02:00
setuid-wrappers.nix Remove some setuid wrappers for non-standard programs 2014-09-05 14:46:36 +02:00
sudo.nix sg: add setuid wrapper. (newgrp is a symlink to sg and was already setuid). 2015-03-30 23:50:45 +01:00