security-misc/lib/systemd/system/proc-hidepid.service

## Copyright (C) 2019 - 2021 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

[Unit]
Description=Mounts /proc with hidepid=2
Documentation=https://github.com/Whonix/security-misc
DefaultDependencies=no
Before=sysinit.target
Requires=local-fs.target
After=local-fs.target

[Service]
Type=oneshot
ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc
RemainAfterExit=yes

[Install]
WantedBy=sysinit.target
copyright 2021-03-17 20:45:21 +07:00			`## Copyright (C) 2019 - 2021 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>`
Add licensing 2019-06-30 20:22:43 +07:00			`## See the file COPYING for copying conditions.`

Create proc-hidepid.service 2019-06-30 05:27:24 +07:00			`[Unit]`
			`Description=Mounts /proc with hidepid=2`
Update proc-hidepid.service 2019-06-30 05:28:41 +07:00			`Documentation=https://github.com/Whonix/security-misc`
hidepid before sysinit.target 2019-09-10 23:23:00 +07:00			`DefaultDependencies=no`
			`Before=sysinit.target`
Create proc-hidepid.service 2019-06-30 05:27:24 +07:00			`Requires=local-fs.target`
			`After=local-fs.target`

			`[Service]`
			`Type=oneshot`
			`ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc`
systemd RemainAfterExit=yes for better usability https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618/33 2021-04-03 22:44:13 +07:00			`RemainAfterExit=yes`
comment out proc-hidepid.service hardening for now since broken in Qubes Debian AppVMs https://forums.whonix.org/t/kernel-hardening/7296/104 2019-07-01 14:43:02 +07:00
Create proc-hidepid.service 2019-06-30 05:27:24 +07:00			`[Install]`
fix systemd unit file proc-hidepid.service: WantedBy=sysinit.target 2019-10-05 16:14:54 +07:00			`WantedBy=sysinit.target`