In this lesson, you will learn how to harden your Linux system by restricting user access to process information, preventing local reconnaissance by unauthorized users.
The Problem with /proc
By default, the Linux /proc filesystem allows any user to view information about all running processes. If you run ps aux as a standard user, you can see every process on the system, including those owned by other users or root. This is a significant security risk: an attacker can identify running services, locate sensitive configuration files, or detect vulnerabilities in background daemons simply by inspecting the command-line arguments and environment variables of active processes.
Hiding Process Data with hidepid
To restrict this, we use the hidepid mount option for the /proc filesystem. When hidepid is enabled, the kernel restricts access to process entries in /proc so that users can only see their own processes.
You can implement this by modifying the /etc/fstab file. Locate the line for proc and append the hidepid option:
proc /proc proc defaults,hidepid=2 0 0
Understanding the Modes
The hidepid option accepts three primary levels:
hidepid=0: The default behavior; everyone can see everything.hidepid=1: Users can only see their own processes, but they can still see the existence of other processes in the process table (though they cannot access detailed information like/proc/[pid]/fdor/proc/[pid]/environ).hidepid=2: Users can only see their own processes. Directories for other processes are completely hidden from the directory listing.
After updating /etc/fstab, you can remount the /proc filesystem to apply the changes without a reboot:
mount -o remount,hidepid=2 /proc
Security Considerations
Once hidepid is set to 2, tools like ps, top, and htop will only report processes owned by the user running them. This effectively blinds an attacker who might be trying to map out the system architecture. Note that if you have monitoring tools (like nagios or zabbix) that need to inspect system-wide processes, you may need to add the service user to a specific group and use the gid mount option alongside hidepid to grant those specific users visibility.
Key Takeaway: By mounting /proc with hidepid=2, you restrict user visibility to their own processes, neutralizing a primary vector for internal system reconnaissance.