improve hide-hardware-info.service, make /sys hiding optional

A systemd service restricts /proc/cpuinfo, /proc/bus, /proc/scsi and /sys to the root user. This hides a lot of hardware identifiers from unprivileged users and increases security as /sys exposes a lot of information that shouldn't be accessible to unprivileged users. As this will break many things, it is disabled by default and can optionally be enabled by executing systemctl enable hide-hardware-info.service as root.

Ok.

Although not tested, I am almost 100% sure practically all the breakage is caused by restricting /sys. My recommendation is, we leave this one out. Add /proc/kallsyms to the list as well, as this contains all the memory addresses for each kernel symbol. And enable what we already have, restricting the sub-directories under proc.

Should I follow with the respective pull?

I am not sure how that PR would look but I guess rather small.

Since this is not enabled by default and for extra security, I tend to add what you suggested here.

Worth trying.

hide-hardware-info.service issues:

But these are all probably related to /sys.

Could you test please if these work?

related:
https://www.kicksecure.com/wiki/Security-misc#Restrict_Hardware_Information_to_Root

Actually we do not even need that service I think. We can set the permissions using the permission hardener service. We are just going to do these with the already existing permission hardener service.

That's an interesting idea to get rid of the extra service. Nice in theory, but...

Could you check please what other features the current implementation has?

chmod 400 /proc/kallsyms
chmod 400 /proc/cpuinfo
chmod 500 /proc/bus

Nice idea but permission-hardener no longer runs at boot time. Only at package install time or when run manually. This was changed to fix the slow/broken boot issues. But changes to /proc (or /sys) need to be done at boot time since these are virtual file systems which are created during boot.

Even only hide-hardware-info.service was reported to slow down the boot process.

So I guess the best way here is to improve hide-hardware-info.service?

harden more (the 3 items you suggested)
harden all except /sys by default?
- /sys only opt-in due to the issues.

Ok.

PR to update the script run by hide-hardware-info.service would be welcome.

Do the doable by default.
/sys opt-in.
The systemd unit file enhancements? sysinit-post.target (Similar to remount-secure.service.)

This one seems really cool and doable.

Ping @monsieuremre

Created

sgid (set-group-ID) pkexec to fix hidepid #201

for it.

While debugging another issue, I figured out that /usr/lib/policykit-1-gnome/polkit-gnome-authentication-agent-1 is trying to stat /sys/fs/cgroup/ but failing and then exiting because of it. When I allow access to this path, the polkit agent is running and the password prompt working. To address this, we would need to allow access to /sys, but can block anything under /sys/* except for /sys/fs/ which needs to be accessible by the polkit agent. Then we can again block access to anything under /sys/fs/*
With those changes polkit is working as expected.

related to flatpak:

Test whether sysfs mountpoints are accessible before mounting them flatpak/flatpak#5697

A smaller change only required here, not mixed with remounting.

#202 had interesting suggestions.

chmod 0500 /sys/block
#chmod 0500 /sys/class
#chmod 0500 /sys/devices
#chmod 0500 /sys/fs
chmod 0500 /sys/kernel
chmod 0500 /sys/power
chmod 0500 /sys/bus
#chmod 0500 /sys/dev
chmod 0500 /sys/firmware
chmod 0500 /sys/hypervisor
chmod 0500 /sys/module

mount --make-private

improve output

This is what's happening after merging #204.

usr/libexec/security-misc/hide-hardware-info: INFO: START
INFO: whitelist executing: chgrp --quiet --recursive cpuinfo /proc/cpuinfo
INFO: whitelist executing: chmod o-rwx /proc/cpuinfo
INFO: normal executing   : chmod og-rwx /proc/bus
INFO: normal executing   : chmod og-rwx /proc/scsi
INFO: whitelist executing: chgrp --quiet --recursive sysfs /sys
INFO: whitelist executing: chmod o-rwx /sys
INFO: normal executing   : chmod o-rwx /sys/block
INFO: normal executing   : chmod o-rwx /sys/bus
INFO: normal executing   : chmod o-rwx /sys/class
INFO: normal executing   : chmod o-rwx /sys/dev
INFO: normal executing   : chmod o-rwx /sys/devices
INFO: normal executing   : chmod o-rwx /sys/firmware
INFO: normal executing   : chmod o-rwx /sys/fs
INFO: normal executing   : chmod o-rwx /sys/hypervisor
INFO: normal executing   : chmod o-rwx /sys/kernel
INFO: normal executing   : chmod o-rwx /sys/module
INFO: normal executing   : chmod o-rwx /sys/power
INFO: normal executing   : chmod o-rwx /sys/fs/bpf
INFO: normal executing   : chmod o-rwx /sys/fs/btrfs
INFO: normal executing   : chmod o-rwx /sys/fs/cgroup
INFO: normal executing   : chmod o-rwx /sys/fs/ext4
INFO: normal executing   : chmod o-rwx /sys/fs/fuse
INFO: normal executing   : chmod o-rwx /sys/fs/pstore
INFO: normal executing   : chmod o+rx /sys /sys/fs
usr/libexec/security-misc/hide-hardware-info: INFO: END

Needs testing.

improve output

use long options

But for sensitive proc, I think I found a better way. We can modify the mount options. Procfs has the mount option subset. We can set this to the subsets that we want to be available. If we set the option subset=pid, then pid is visible to everyone (the default), but everything else invisible, including /proc/dma /proc/consoles /proc/cmdline /proc/iomem and like a billion other things you can check them with ls /proc. I know for a fact that hiding memory access and device stuff and kernel arguments is good and does not break anything. i am not sure what can be hidden here without breakage, but I will test and find out the optimal mount options for proc.

Created,

remount-secure: use procfs mount option subset (hide-hardware-info.service) #205

for it.

flatpak: thanks to #204 this is now fixed.

#202 had interesting suggestions.

chmod 0500 /sys/block
#chmod 0500 /sys/class
#chmod 0500 /sys/devices
#chmod 0500 /sys/fs
chmod 0500 /sys/kernel
chmod 0500 /sys/power
chmod 0500 /sys/bus
#chmod 0500 /sys/dev
chmod 0500 /sys/firmware
chmod 0500 /sys/hypervisor
chmod 0500 /sys/module

These are all covered by default.

/proc/kallsyms

Created,

hide-hardware-info.service: hide /proc/kallsyms #206

for it.

For enable hide-hardware-information.service by default, please open a separate ticket if you wish to suggest that.

All was implemented what has been discussed in this ticket or follow-up tickets have been created. If something has been forgotten, I guess small, actionable follow-up tickets would be the most productive.

hide-hardware-information.service known issues:
https://www.kicksecure.com/wiki/Security-misc#Reduce_Kernel_Information_Leaks_-_Known_Issues

Navigation Menu

Repository navigation

improve hide-hardware-info.service, make `/sys` hiding optional #172

2 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

improve hide-hardware-info.service, make /sys hiding optional #172

Description

Activity

adrelanos commented on Nov 20, 2023

adrelanos commented on Nov 21, 2023

adrelanos commented on Nov 21, 2023

adrelanos commented on Nov 23, 2023

adrelanos commented on Jan 10, 2024

adrelanos commented on Feb 18, 2024

DanWin commented on Feb 18, 2024

adrelanos commented on Feb 19, 2024

2 remaining items

adrelanos commented on Feb 21, 2024

adrelanos commented on Feb 22, 2024

adrelanos commented on Feb 26, 2024

adrelanos commented on Feb 26, 2024

adrelanos commented on Feb 26, 2024

adrelanos commented on Mar 11, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

improve hide-hardware-info.service, make `/sys` hiding optional #172