Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to restrict /usr/bin/top on Linux with AppArmor so it will display only the processes of the current user? In addition to that, /bin/ls /proc must not show any of the PIDs belonging to other users.

share|improve this question
    
What about ps? –  Dennis Williamson Dec 11 '10 at 14:50

2 Answers 2

up vote 1 down vote accepted

Short answer

No, that is not something you can easily do with AppArmor. It is not hard to modify top and ls to do this, but bypassing these changes is trivial (roll your own ls and top). Modifying access to the /proc file system is likely to break many applications.

Long answer

Linux does not have this functionality built in as far as I know. You would have to modify the kernel to ensure that no system call can leak information about processes running for other users, but that's a large project. And the question remains... Why? If a user has shell access on your server the user can do lots of nasty things. If you want to restrict a user so he can not interact with the rest of the server you should put him into a container of some sort. Virtual machines are excellent for this.

share|improve this answer

The only way to do this is to install a kernel patch. I recommend grSecurity. That will only show the users processes in a ps and should also limit it via top. If it doesn't the best thing to do in that case is

chmod 700 /usr/bin/top

So only root can run it. Most shell users would never even need top

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.