Joachim Fasting cef2814a4f nixos: add optional process information hiding ... This module adds an option `security.hideProcessInformation` that, when enabled, restricts access to process information such as command-line arguments to the process owner. The module adds a static group "proc" whose members are exempt from process information hiding. Ideally, this feature would be implemented by simply adding the appropriate mount options to `fileSystems."/proc".fsOptions`, but this was found to not work in vmtests. To ensure that process information hiding is enforced, we use a systemd service unit that remounts `/proc` after `systemd-remount-fs.service` has completed. To verify the correctness of the feature, simple tests were added to nixos/tests/misc: the test ensures that unprivileged users cannot see process information owned by another user, while members of "proc" CAN. Thanks to @abbradar for feedback and suggestions.		2016-04-10 12:27:06 +02:00
..
assertions.nix
crashdump.nix
extra-arguments.nix
ids.nix	nixos: add optional process information hiding	2016-04-10 12:27:06 +02:00
lib.nix
locate.nix
meta.nix	Revert "Add the tool "nixos-typecheck" that can check an option declaration to:"	2016-03-01 20:52:06 +01:00
nixpkgs.nix	Revert "Add the tool "nixos-typecheck" that can check an option declaration to:"	2016-03-01 20:52:06 +01:00
passthru.nix
version.nix	NixOS 16.09 is called Flounder	2016-03-14 19:09:54 +00:00