While that's a good point, you could say the same thing for a few of the
options in here.
IPTables, SELinux, etc...
They *all* say: "do this but turn it off if it doesn't work for you".
In the hidepid case, you can add the gid= option to allow monitoring
systems access to the proc table which has worked around all issues that
I've seen so far.
If you decide to do this on EL7, be aware that you'll need to start
mcstransd (if you're using it) with the group that you specify in the gid=
option.
If you have specific cases where the risk of arbitrary user process
enumeration outweighs the benefits, I would be most interested to hear
them. Fundamentally, this is antithetical to the container approach to the
world that is being pushed by so many.
I have seen some issues with poorly written software and have filed bugs
with those vendors since they are asking for privileges which they do not
require.
Thanks,
Trevor
On Thu, Jan 19, 2017 at 11:58 AM, Paul Whitney <paul.whitney(a)mac.com> wrote:
While I think this is a great feature to use, I would not make it
mandatory. We have seen this feature impact functionality of certain
applications when enabled.
Paul M. Whitney
E-mail: paul.whitney(a)mac.com
Cell: 410.493.9448 <(410)%20493-9448>
Sent from my browser.
On Jan 19, 2017, at 11:19 AM, Trevor Vaughan <tvaughan(a)onyxpoint.com>
wrote:
Hi All,
For some time now, I've been adding 'hidepid=2' to my systems to limit
process list access to the users that own the processes themselves.
I would like to propose that this be added to the SSG since it provides a
very straightforward mechanism for reducing system process enumeration by
regular users and/or rogue daemons.
Thanks,
Trevor
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788 <(410)%20541-6699>
-- This account not approved for unencrypted proprietary information --
_______________________________________________
scap-security-guide mailing list -- scap-security-guide@lists.
fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave@
lists.fedorahosted.org
_______________________________________________
scap-security-guide mailing list -- scap-security-guide@lists.
fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave@
lists.fedorahosted.org
--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788
-- This account not approved for unencrypted proprietary information --