proc: add option to mount only a pids subset

This allows to hide all files and directories in the procfs that are not
related to tasks.

Signed-off-by: Alexey Gladkov <gladkov.alexey@gmail.com>
Reviewed-by: Alexey Dobriyan <adobriyan@gmail.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
This commit is contained in:
Alexey Gladkov
2020-04-19 16:10:54 +02:00
committed by Eric W. Biederman
parent 24a71ce5c4
commit 6814ef2d99
4 changed files with 55 additions and 0 deletions

View File

@@ -50,12 +50,19 @@ enum {
HIDEPID_NOT_PTRACEABLE = 4, /* Limit pids to only ptraceable pids */
};
/* definitions for proc mount option pidonly */
enum {
PROC_PIDONLY_OFF = 0,
PROC_PIDONLY_ON = 1,
};
struct proc_fs_info {
struct pid_namespace *pid_ns;
struct dentry *proc_self; /* For /proc/self */
struct dentry *proc_thread_self; /* For /proc/thread-self */
kgid_t pid_gid;
int hide_pid;
int pidonly;
};
static inline struct proc_fs_info *proc_sb_info(struct super_block *sb)