From 301e7cd047c8d07715d5dc37f713e8aa031581b4 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 14 Mar 2021 12:36:15 +0000 Subject: [PATCH] man: specify that ProtectProc= does not work with root/cap_sys_ptrace When using hidepid=invisible on procfs, the kernel will check if the gid of the process trying to access /proc is the same as the gid of the process that mounted the /proc instance, or if it has the ptrace capability: https://github.com/torvalds/linux/blob/v5.10/fs/proc/base.c#L723 https://github.com/torvalds/linux/blob/v5.10/fs/proc/root.c#L155 Given we set up the /proc instance as root for system services, The same restriction applies to CAP_SYS_PTRACE, if a process runs with it then hidepid=invisible has no effect. ProtectProc effectively can only be used with User= or DynamicUser=yes, without CAP_SYS_PTRACE. Update the documentation to explicitly state these limitations. Fixes #18997 --- man/systemd.exec.xml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml index 8d4e1143e3e..5bb9af3e7da 100644 --- a/man/systemd.exec.xml +++ b/man/systemd.exec.xml @@ -285,8 +285,11 @@ Filesystem. It is generally recommended to run most system services with this option set to invisible. This option is implemented via file system namespacing, and thus cannot be used with services that shall be able to install mount points in the host file system - hierarchy. It also cannot be used for services that need to access metainformation about other users' - processes. This option implies MountAPIVFS=. + hierarchy. Note that the root user is unaffected by this option, so to be effective it has to be used + together with User= or DynamicUser=yes, and also without the + CAP_SYS_PTRACE capability, which also allows a process to bypass this feature. It + cannot be used for services that need to access metainformation about other users' processes. This + option implies MountAPIVFS=. If the kernel doesn't support per-mount point mount options this setting remains without effect, and the unit's processes will be able to access and see other process