While that's a good point, you could say the same thing for a few of the options in here.

IPTables, SELinux, etc...

They *all* say: "do this but turn it off if it doesn't work for you".

In the hidepid case, you can add the gid= option to allow monitoring systems access to the proc table which has worked around all issues that I've seen so far.

If you decide to do this on EL7, be aware that you'll need to start mcstransd (if you're using it) with the group that you specify in the gid= option.

If you have specific cases where the risk of arbitrary user process enumeration outweighs the benefits, I would be most interested to hear them. Fundamentally, this is antithetical to the container approach to the world that is being pushed by so many.

I have seen some issues with poorly written software and have filed bugs with those vendors since they are asking for privileges which they do not require.

Thanks,

Trevor

On Thu, Jan 19, 2017 at 11:58 AM, Paul Whitney <paul.whitney@mac.com> wrote:
While I think this is a great feature to use, I would not make it mandatory.  We have seen this feature impact functionality of certain applications when enabled.
Paul M. Whitney
E-mail: paul.whitney@mac.com
Cell:     410.493.9448
Sent from my browser.



On Jan 19, 2017, at 11:19 AM, Trevor Vaughan <tvaughan@onyxpoint.com> wrote:

Hi All,

For some time now, I've been adding 'hidepid=2' to my systems to limit process list access to the users that own the processes themselves.

I would like to propose that this be added to the SSG since it provides a very straightforward mechanism for reducing system process enumeration by regular users and/or rogue daemons.

Thanks,

Trevor

--
Trevor Vaughan
Vice President, Onyx Point, Inc

-- This account not approved for unencrypted proprietary information --
_______________________________________________
scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org

_______________________________________________
scap-security-guide mailing list -- scap-security-guide@lists.fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave@lists.fedorahosted.org




--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788

-- This account not approved for unencrypted proprietary information --