Hacker News Reader

Comment by amelius | Hacker News Reader

When I type "ps -aux", why do I get all the information from other users too? Shouldn't this be private information by default?

View on HN

Why? Because Unix was written in the 1970s when privacy and computer security where not a topic yet. Hardenings have been added later, but the one you mention is still not the default.

You can harden your system using hidepid.

Chapter 4.1: https://www.kernel.org/doc/html/latest/filesystems/proc.html

My point: why isn't this private __by default__?

(Also, I fear that by setting this flag it will break a lot of tools that expect the flag to be 0)

On FreeBSD there's a sysctl to control it and there's a kernel module you can configure to allow specific UIDs/GIDs to see everything so you can still allow your monitoring tools to do their job without being root, for example. It's a standard config in places I've worked

It's configurable - "hidepid=1" mount option on procfs.

Careful, this won't stop systemctl from showing the full process command line in its output.

Hmm, that's not why I am seeing

             ├─kopano-server.service 
             │ └─2685 n/a
             ├─systemd-logind.service 
             │ └─1037 n/a
             └─kopano-gateway.service 
               ├─    959 n/a
               ├─   1413 n/a
               ├─  52489 n/a

Reply on news.ycombinator.com