security-misc/usr/lib/systemd/system/proc-hidepid.service

## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

[Unit]
Description=Mounts /proc with hidepid=2
Documentation=https://github.com/Kicksecure/security-misc

DefaultDependencies=no
Before=sysinit.target
Requires=local-fs.target
After=local-fs.target

[Service]
Type=oneshot
ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2,gid=proc /proc
RemainAfterExit=yes

[Install]
WantedBy=sysinit.target
Update Copyright (C) to 2024 2024-05-11 10:18:36 +07:00			`## Copyright (C) 2019 - 2024 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>`
Add licensing 2019-06-30 20:22:43 +07:00			`## See the file COPYING for copying conditions.`

Create proc-hidepid.service 2019-06-30 05:27:24 +07:00			`[Unit]`
			`Description=Mounts /proc with hidepid=2`
documentation 2023-10-22 16:41:56 +07:00			`Documentation=https://github.com/Kicksecure/security-misc`
newline 2023-11-06 08:13:14 +07:00
hidepid before sysinit.target 2019-09-10 23:23:00 +07:00			`DefaultDependencies=no`
			`Before=sysinit.target`
Create proc-hidepid.service 2019-06-30 05:27:24 +07:00			`Requires=local-fs.target`
			`After=local-fs.target`

			`[Service]`
			`Type=oneshot`
`proc-hidepid.service` add `gid=proc` This allows users that are a member of the `proc` group to be excluded from `hidepid` protections. https://github.com/Kicksecure/security-misc/issues/208 2024-03-10 19:44:53 +07:00			`ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2,gid=proc /proc`
systemd RemainAfterExit=yes for better usability https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618/33 2021-04-03 22:44:13 +07:00			`RemainAfterExit=yes`
comment out proc-hidepid.service hardening for now since broken in Qubes Debian AppVMs https://forums.whonix.org/t/kernel-hardening/7296/104 2019-07-01 14:43:02 +07:00
Create proc-hidepid.service 2019-06-30 05:27:24 +07:00			`[Install]`
fix systemd unit file proc-hidepid.service: WantedBy=sysinit.target 2019-10-05 16:14:54 +07:00			`WantedBy=sysinit.target`