How deny listing processes?

[pelikan81]

Hi,
i have problem: i want to deny listing processes (program ps) for any user except his own processes, for example: when is logged in user: pelikan, and when type ps (plus some parameters) the displayed processes is only his processes.
does anybody know how ?
thanx
pelikan

 

[coffeysm]

Forgot this might be a little security vulnerability, but you can set permissions to:

chown nobody:sys /usr/bin/ps
chmod 711 /usr/bin/ps

On Solaris that way user's can not cat the file to see what it calls, but it will still execute with the SUID. Since it is the user nobody though, should not be too much of big deal.

 

[coffeysm]

Whoops forgot the SUID part should read:

chmod 4711 /usr/bin/ps

 

[columb]

Unfortunately (or not?) you can't set the SUID bit on scripts on AIX. You would have to use sudo in this instance. (see my suggestion several comments back)

This is still open to lgarner's comment about copying ps from another system but anything we suggest will be prone to that.

Columb Healy

 

[coffeysm]

Good point I never played with AIX, I heard of other flavors not allowing that though. I think he wants to run it on Linux and I do not know if they allow scripts to be SUID or not.

It also appears that most of the solutions provided control who can run the actual ps command.I think all he wants to do is omit/deny users from seeing all the processes on the system.

If that is all he would like done then I do not see a need to use SUDO. I think it would be easier to write a shell script to just grep for the username of the person running the ps command.

 

[feherke]

Hi

$PS -aef | $GREP $USER

And what if the user set the $USER variable to something else ? For example a . ( period ).

Feherke.

http://rootshell.be/~feherke/

 

[Annihilannic]

I think the only way to reliably achieve this is to change the permissions of /proc, maybe only giving a certain group access to it. However that would prevent the users from seeing even their own processes, and might break some other stuff.

Ideally the proc fs could be modified to make the default permissions of /proc/<pid> entries either 500 or 550. ps would probably have to be modified as well to prevent it complaining about the ones it can't access.

Annihilannic.

 

[coffeysm]

Well if a user is smart enough to change a variable, or let alone know what one is. Then there is no full proof way to do this like Annihilanic says his solution is probably the best. But you could always hard code the USER variable in the script, I wrote that up as a quick solution. You could do something like use the id command and strip out the username.