In this lesson, you will learn how to restrict access to sensitive virtual file system (VFS) nodes like /proc and /sys to prevent information leakage and unauthorized hardware interaction.
Understanding the VFS Exposure
The Virtual File System (VFS) acts as the bridge between the kernel and user space. Directories like /proc and /sys are not actual files on your disk; they are interfaces that expose real-time kernel data, process information, and hardware parameters. While essential for system administration, they are often exploited by attackers to gather system intelligence or manipulate hardware states.
In a hardened environment, you should never allow processes to have unrestricted access to these directories. If a malicious process can read /proc/kallsyms, it gains a map of the kernel's memory, which is the first step in crafting an exploit.
Restricting Access via Mount Options
The most effective way to harden these areas is through restrictive mount flags. When mounting these pseudo-filesystems, you should apply the hidepid option to /proc. This prevents users from seeing processes they do not own:
# Remounting /proc to hide other users' processes
mount -o remount,hidepid=2 /proc
In this configuration, hidepid=2 ensures that a user can only see their own processes within /proc. Attempting to list processes owned by other users or the root user will simply return an "Access Denied" error or hide the directory entirely.
Applying MAC Policies
Beyond mount flags, Mandatory Access Control (MAC) systems allow for granular control over individual nodes within /sys. For example, you can use AppArmor or SELinux to deny write access to power management interfaces or network settings that reside in /sys/class.
Instead of broad permissions, you define specific profiles that only allow the necessary system daemons to interact with these nodes. By "pinning" these permissions, you ensure that even if an application is compromised, the attacker cannot toggle hardware switches or extract sensitive hardware metadata through the VFS.
Key Takeaway: Hardening the VFS involves using mount options like hidepid and MAC policies to treat /proc and /sys as restricted interfaces, thereby preventing unauthorized information disclosure and hardware manipulation.