Re: [cobalt-users] securing "ps"

[flash22@xxxxxxx]

On Thu, 15 Nov 2001, Steve Werby wrote:

> "Jonathan M. Slivko" <jslivko@xxxxxxxxxxxx> wrote:
> > Has anyone here ever successfully secured "ps" on a RaQ4i so it will only
> > show the current users proccesses, and not all of the systems proccesses
> > when a ps aux is done? Also, are there any good security sites just
> devoted
> > to Cobalt's that I should look into for securing my system?
> 
> I haven't tried, but if I wanted that behavior I'd do something like this:
> 
> Move /bin/ps to a new location and give it an obscure name.  Right a bash
> script that limits what ps outputs and what flags can be used with it (if
> that's another concern) and name it /bin/ps and make it chmod 555 or
> something else that's appropriate.  A quick hack would be something like
> 
> #!/bin/sh
> 
> ps | grep $USER
> 
> That's not a perfect solution, but it'll get you started.

and as a user i'd just ls /proc ;)

The real way to do this is to restrict access to proc (via mount options, 
that *is* why it's mountable ;), but this will also
break some things in linux...quite a few in fact ;)

Given that a user can probably make pretty educated guesses about what's
probably running on a web server , i don't really see why a restricted
ps is all that much safer than a normal one ;)

gsh