--Cx6gHIjlhIvUM2fk
Content-Type: text/plain; charset=iso-8859-2
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Nov 13, 2004 at 09:54:49AM +0100, Jaromir Dolecek wrote:
+> > One thing that is definitely a very good privacy/security feature is=
=20
+> > what FreeBSD implemented that can prevent users seeing the PIDs (or=20
+> > indeed any info) of processes they don't own, via ps or top or whateve=
r=20
+> > else. Nobody can argue that this is a Good Thing on a shared shell=20
+> > server. Whether or not this is easy to implement cleanly is another ma=
tter.
+>=20
+> This might indeed be useful. I had a look into this, and it seems
+> this could easily be implemented with one condition in
+> init_sysctl.c:sysctl_doeproc(), plus some sysctl machinery
+> to export setting to userland.

Not so fast:) In FreeBSD 5.x it is much more complete solution that it
was in 4.x. And remember that you have to protect also things like:
- procfs,
- sockets (i.e. netstat output),
- kill(2) (to return ESRCH, instead of EPERM),
and few others.

But this is very useful, indeed.

--=20
Pawel Jakub Dawidek                       http://www.FreeBSD.org
pjd@FreeBSD.org                           http://garage.freebsd.pl
FreeBSD committer                         Am I Evil? Yes, I Am!

--Cx6gHIjlhIvUM2fk
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)

iD8DBQFBpii4ForvXbEpPzQRAlYzAKCqrRp65HrXIVBYzCyZvHtzjvSARQCgvhM0
/v31YGD01YKZ3iMTny22Q00=
=etY9
-----END PGP SIGNATURE-----

--Cx6gHIjlhIvUM2fk--