security-misc/lib/systemd/system/proc-hidepid.service

## Copyright (C) 2019 - 2021 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

[Unit]
Description=Mounts /proc with hidepid=2
Documentation=https://github.com/Whonix/security-misc
DefaultDependencies=no
Before=sysinit.target
Requires=local-fs.target
After=local-fs.target

[Service]
Type=oneshot
ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc
RemainAfterExit=yes

[Install]
WantedBy=sysinit.target
copyright 2021-03-17 09:45:21 -04:00			`## Copyright (C) 2019 - 2021 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>`
Add licensing 2019-06-30 09:22:43 -04:00			`## See the file COPYING for copying conditions.`

Create proc-hidepid.service 2019-06-29 18:27:24 -04:00			`[Unit]`
			`Description=Mounts /proc with hidepid=2`
Update proc-hidepid.service 2019-06-29 18:28:41 -04:00			`Documentation=https://github.com/Whonix/security-misc`
hidepid before sysinit.target 2019-09-10 12:23:00 -04:00			`DefaultDependencies=no`
			`Before=sysinit.target`
Create proc-hidepid.service 2019-06-29 18:27:24 -04:00			`Requires=local-fs.target`
			`After=local-fs.target`

			`[Service]`
			`Type=oneshot`
			`ExecStart=/bin/mount -o remount,nosuid,nodev,noexec,hidepid=2 /proc`
systemd RemainAfterExit=yes for better usability https://forums.whonix.org/t/restrict-hardware-information-to-root-testers-wanted/8618/33 2021-04-03 11:44:13 -04:00			`RemainAfterExit=yes`
comment out proc-hidepid.service hardening for now since broken in Qubes Debian AppVMs https://forums.whonix.org/t/kernel-hardening/7296/104 2019-07-01 03:43:02 -04:00
Create proc-hidepid.service 2019-06-29 18:27:24 -04:00			`[Install]`
fix systemd unit file proc-hidepid.service: WantedBy=sysinit.target 2019-10-05 05:14:54 -04:00			`WantedBy=sysinit.target`