···

       
207
       
207
       
 
       
  ./security/dhparams.nix

     

       
208
       
208
       
 
       
  ./security/duosec.nix

     

       
209
       
209
       
 
       
  ./security/google_oslogin.nix

     

       
210
       
210
       
-
       
  ./security/hidepid.nix

     

       
211
       
210
       
 
       
  ./security/lock-kernel-modules.nix

     

       
212
       
211
       
 
       
  ./security/misc.nix

     

       
213
       
212
       
 
       
  ./security/oath.nix

     

···

       
22
       
22
       
 
       
  environment.memoryAllocator.provider = mkDefault "scudo";

     

       
23
       
23
       
 
       
  environment.variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1";

     

       
24
       
24
       
 
       


     

       
25
       
25
       
-
       
  security.hideProcessInformation = mkDefault true;

     

       
26
       
26
       
-
       


     

       
27
       
25
       
 
       
  security.lockKernelModules = mkDefault true;

     

       
28
       
26
       
 
       


     

       
29
       
27
       
 
       
  security.protectKernelImage = mkDefault true;

     

···

       
73
       
73
       
 
       
    (mkRemovedOptionModule [ "services" "venus" ] "The corresponding package was removed from nixpkgs.")

     

       
74
       
74
       
 
       
    (mkRemovedOptionModule [ "services" "flashpolicyd" ] "The flashpolicyd module has been removed. Adobe Flash Player is deprecated.")

     

       
75
       
75
       
 
       


     

       
76
       
76
       
+
       
    (mkRemovedOptionModule [ "security" "hideProcessInformation" ] ''

     

       
77
       
77
       
+
       
        The hidepid module was removed, since the underlying machinery

     

       
78
       
78
       
+
       
        is broken when using cgroups-v2.

     

       
79
       
79
       
+
       
    '')

     

       
80
       
80
       
+
       


     

       
76
       
81
       
 
       
    # Do NOT add any option renames here, see top of the file

     

       
77
       
82
       
 
       
  ];

     

       
78
       
83
       
 
       
}

     

···

       
1
       
1
       
-
       
{ config, lib, ... }:

     

       
2
       
2
       
-
       
with lib;

     

       
3
       
3
       
-
       


     

       
4
       
4
       
-
       
{

     

       
5
       
5
       
-
       
  meta = {

     

       
6
       
6
       
-
       
    maintainers = [ maintainers.joachifm ];

     

       
7
       
7
       
-
       
    doc = ./hidepid.xml;

     

       
8
       
8
       
-
       
  };

     

       
9
       
9
       
-
       


     

       
10
       
10
       
-
       
  options = {

     

       
11
       
11
       
-
       
    security.hideProcessInformation = mkOption {

     

       
12
       
12
       
-
       
      type = types.bool;

     

       
13
       
13
       
-
       
      default = false;

     

       
14
       
14
       
-
       
      description = ''

     

       
15
       
15
       
-
       
        Restrict process information to the owning user.

     

       
16
       
16
       
-
       
      '';

     

       
17
       
17
       
-
       
    };

     

       
18
       
18
       
-
       
  };

     

       
19
       
19
       
-
       


     

       
20
       
20
       
-
       
  config = mkIf config.security.hideProcessInformation {

     

       
21
       
21
       
-
       
    users.groups.proc.gid = config.ids.gids.proc;

     

       
22
       
22
       
-
       
    users.groups.proc.members = [ "polkituser" ];

     

       
23
       
23
       
-
       


     

       
24
       
24
       
-
       
    boot.specialFileSystems."/proc".options = [ "hidepid=2" "gid=${toString config.ids.gids.proc}" ];

     

       
25
       
25
       
-
       
    systemd.services.systemd-logind.serviceConfig.SupplementaryGroups = [ "proc" ];

     

       
26
       
26
       
-
       


     

       
27
       
27
       
-
       
    # Disable cgroupsv2, which doesn't work with hidepid.

     

       
28
       
28
       
-
       
    # https://github.com/NixOS/nixpkgs/pull/104094#issuecomment-729996203

     

       
29
       
29
       
-
       
    systemd.enableUnifiedCgroupHierarchy = false;

     

       
30
       
30
       
-
       
  };

     

       
31
       
31
       
-
       
}

     

···

       
1
       
1
       
-
       
<chapter xmlns="http://docbook.org/ns/docbook"

     

       
2
       
2
       
-
       
         xmlns:xlink="http://www.w3.org/1999/xlink"

     

       
3
       
3
       
-
       
         xmlns:xi="http://www.w3.org/2001/XInclude"

     

       
4
       
4
       
-
       
         version="5.0"

     

       
5
       
5
       
-
       
         xml:id="sec-hidepid">

     

       
6
       
6
       
-
       
 <title>Hiding process information</title>

     

       
7
       
7
       
-
       
 <para>

     

       
8
       
8
       
-
       
  Setting

     

       
9
       
9
       
-
       
<programlisting>

     

       
10
       
10
       
-
       
<xref linkend="opt-security.hideProcessInformation"/> = true;

     

       
11
       
11
       
-
       
</programlisting>

     

       
12
       
12
       
-
       
  ensures that access to process information is restricted to the owning user.

     

       
13
       
13
       
-
       
  This implies, among other things, that command-line arguments remain private.

     

       
14
       
14
       
-
       
  Unless your deployment relies on unprivileged users being able to inspect the

     

       
15
       
15
       
-
       
  process information of other users, this option should be safe to enable.

     

       
16
       
16
       
-
       
 </para>

     

       
17
       
17
       
-
       
 <para>

     

       
18
       
18
       
-
       
  Members of the <literal>proc</literal> group are exempt from process

     

       
19
       
19
       
-
       
  information hiding.

     

       
20
       
20
       
-
       
 </para>

     

       
21
       
21
       
-
       
 <para>

     

       
22
       
22
       
-
       
  To allow a service <replaceable>foo</replaceable> to run without process

     

       
23
       
23
       
-
       
  information hiding, set

     

       
24
       
24
       
-
       
<programlisting>

     

       
25
       
25
       
-
       
<link linkend="opt-systemd.services._name_.serviceConfig">systemd.services.<replaceable>foo</replaceable>.serviceConfig</link>.SupplementaryGroups = [ "proc" ];

     

       
26
       
26
       
-
       
</programlisting>

     

       
27
       
27
       
-
       
 </para>

     

       
28
       
28
       
-
       
</chapter>

     

···

       
65
       
65
       
 
       
          machine.succeed("grep -Fq wireguard /proc/modules")

     

       
66
       
66
       
 
       


     

       
67
       
67
       
 
       


     

       
68
       
68
       
-
       
      # Test hidepid

     

       
69
       
69
       
-
       
      with subtest("hidepid=2 option is applied and works"):

     

       
70
       
70
       
-
       
          # Linux >= 5.8 shows "invisible"

     

       
71
       
71
       
-
       
          machine.succeed(

     

       
72
       
72
       
-
       
              "grep -Fq hidepid=2 /proc/mounts || grep -Fq hidepid=invisible /proc/mounts"

     

       
73
       
73
       
-
       
          )

     

       
74
       
74
       
-
       
          # cannot use pgrep -u here, it segfaults when access to process info is denied

     

       
75
       
75
       
-
       
          machine.succeed("[ `su - sybil -c 'ps --no-headers --user root | wc -l'` = 0 ]")

     

       
76
       
76
       
-
       
          machine.succeed("[ `su - alice -c 'ps --no-headers --user root | wc -l'` != 0 ]")

     

       
77
       
77
       
-
       


     

       
78
       
78
       
-
       


     

       
79
       
68
       
 
       
      # Test kernel module hardening

     

       
80
       
69
       
 
       
      with subtest("No more kernel modules can be loaded"):

     

       
81
       
70
       
 
       
          # note: this better a be module we normally wouldn't load ...