hidepid makes my machine run over X11

Archtorom · 2022-07-01 19:35:54

Hello,

I use Wayland on my machine and want to keep using it. When I enable hidepid and reboot the computer my machine use X11. When I remove the hidepid settings it use Wayland again.

My hidepid settings:

-
/etc/fstab
proc /proc proc nosuid,nodev,noexec,hidepid=2,gid=proc 0 0

/etc/systemd/system/systemd-logind.service.d/hidepid.conf

[Service]
SupplementaryGroups=proc
-

I found this: https://github.com/NixOS/nixpkgs/issues/111629

Is there any workaround?

Last edited by Archtorom (2022-07-01 20:06:02)

seth · 2022-07-01 20:51:38

https://bugs.archlinux.org/task/52450
What "wayland"? Gnome?

Archtorom · 2022-07-07 15:44:55

seth wrote:

https://bugs.archlinux.org/task/52450
What "wayland"? Gnome?

Sorry for my late response. I thought I would get notificated through email.

Yes Gnome 42 wayland. Exactly what Daniel says. Any known workarounds available?

seth · 2022-07-07 16:12:51

Did you add gdm to the proc group?

https://forums.gentoo.org/viewtopic-t-1 … art-0.html sounds like you need at least an exception/supplementary user for gnome-session-binary, maybe in /usr/lib/systemd/user/gnome-session-wayland*.target
https://wiki.archlinux.org/title/Security#hidepid

Archtorom · 2022-07-15 11:40:12

seth wrote:

Did you add gdm to the proc group?

I added gdm to the proc group. It doesn't solve the issue.

seth wrote:

https://forums.gentoo.org/viewtopic-t-1 … art-0.html sounds like you need at least an exception/supplementary user for gnome-session-binary, maybe in /usr/lib/systemd/user/gnome-session-wayland*.target
https://wiki.archlinux.org/title/Security#hidepid

How to do that and is that safe?

seth · 2022-07-15 13:55:15

With a text editor and I don't know.
"safe" is subjective. Why do you seek to hide the PIDs itfp?
You'll exempt (at least) gnome-session-binary, and since gnome has the desire to slouch everything into a single process, this will probably affect a lot of gnome routines and possibly 3rd party scripts ("for sure" if you also have to exempt gnome-shell)

The question you probably need to answer first is "If I want to harden this system, then why am I using gnome?"

Archtorom · 2022-07-15 19:41:57

seth wrote:

With a text editor and I don't know.

Yes what to add.

seth wrote:

"safe" is subjective. Why do you seek to hide the PIDs itfp?

I'm using the arch wiki security page to harden my system

seth wrote:

You'll exempt (at least) gnome-session-binary, and since gnome has the desire to slouch everything into a single process, this will probably affect a lot of gnome routines and possibly 3rd party scripts ("for sure" if you also have to exempt gnome-shell)

Yes what can gdm do being added to the proc group? It gives gnome more privileges to proc related files/dirs/processes? Can gnome read things in the proc it couldn't before? I simply want to hide my pids and make an exception for gnome. But I don't want to give gnome extra privileges. It will be a nice update for the wiki if you know the solution.

seth wrote:

The question you probably need to answer first is "If I want to harden this system, then why am I using gnome?"

I none of the hardening guides I read something about security and desktop environments

seth · 2022-07-15 21:24:58

Yes what to add.

Did you check the link to the wiki I posted?
In case that's not clear, this utilizes https://wiki.archlinux.org/title/Systemd#Drop-in_files - you just have to do that for the gnome session service or target (depending on which starts gnome-session-binary)

I'm using the arch wiki security page to harden my system

Yes what can gdm do being added to the proc group? It gives gnome more privileges to proc related files/dirs/processes?

It will be a nice update for the wiki if you know the solution.

The wiki wrote:

The proc group, provided by the filesystem package, acts as a whitelist of users authorized to learn other users' process information. If users or services need access to /proc/<pid> directories beyond their own, add them to the group.

Can gnome read things in the proc it couldn't before?

Yes, that's the point of

I simply want to hide my pids and make an exception for gnome.

But I don't want to give gnome extra privileges.

That's impossible. You have to give gnome extra privileges in order to access privileged information. That's the exception.

I none of the hardening guides I read something about security and desktop environments

Because these two things pretty much contradict each other.
Gnome is presently w/o modifications incompatible w/ hidepid (and other stuff) because security and comfort exist on a spectrum and the more you're moving to "desktop environment", the more you're moving away from "security".
Making gnome compatible w/ hidepid will likely require functional sacrifices and giving gnome an exception rips a giant hole into the hidepid feature that you need to mitigate by castrating gnome (notably preventing the user from installing 3rd party scripts what can do whatever in the context of at least the gnome-shell process)
Another implication of "Gnome is presently incompatible w/ hidepid" is that nobody using gnome cares about the proc isolation and nobody who worries about the proc isolation uses gnome.

Arch Linux

#1 2022-07-01 19:35:54

hidepid makes my machine run over X11

#2 2022-07-01 20:51:38

Re: hidepid makes my machine run over X11

#3 2022-07-07 15:44:55

Re: hidepid makes my machine run over X11

#4 2022-07-07 16:12:51

Re: hidepid makes my machine run over X11

#5 2022-07-15 11:40:12

Re: hidepid makes my machine run over X11

#6 2022-07-15 13:55:15

Re: hidepid makes my machine run over X11

#7 2022-07-15 19:41:57

Re: hidepid makes my machine run over X11

#8 2022-07-15 21:24:58

Re: hidepid makes my machine run over X11

Board footer