top 只顯示目前使用者進程

Question 1

一種可能性是使用或來/proc安裝。此掛載選項已添加到後來的 Linux 核心中，並在 CentOS 5.9 和 6.3 周圍的某個時間向後移植。 hidepid=1hidepid=2

Mount options
   The proc filesystem supports the following mount options:

   hidepid=n (since Linux 3.3)
          This option controls who can access the information in
          /proc/[pid] directories.  The argument, n, is one of the
          following values:

          0   Everybody may access all /proc/[pid] directories.  This is
              the traditional behavior, and the default if this mount
              option is not specified.

          1   Users may not access files and subdirectories inside any
              /proc/[pid] directories but their own (the /proc/[pid]
              directories themselves remain visible).  Sensitive files
              such as /proc/[pid]/cmdline and /proc/[pid]/status are now
              protected against other users.  This makes it impossible
              to learn whether any user is running a specific program
              (so long as the program doesn't otherwise reveal itself by
              its behavior).

          2   As for mode 1, but in addition the /proc/[pid] directories
              belonging to other users become invisible.  This means
              that /proc/[pid] entries can no longer be used to discover
              the PIDs on the system.  This doesn't hide the fact that a
              process with a specific PID value exists (it can be
              learned by other means, for example, by "kill -0 $PID"),
              but it hides a process's UID and GID, which could
              otherwise be learned by employing stat(2) on a /proc/[pid]
              directory.  This greatly complicates an attacker's task of
              gathering information about running processes (e.g.,
              discovering whether some daemon is running with elevated
              privileges, whether another user is running some sensitive
              program, whether other users are running any program at
              all, and so on).

另一種可能性（由發布者發現並添加到此答案作為參考資訊）是網路安全它具有向非特權用戶隱藏其他用戶進程的功能，作為其一部分文件系統強化。

為非特權使用者隱藏其他使用者的進程

雖然上游核心現在為/proc 提供了一個掛載選項來隱藏其他非特權用戶的進程，但grsecurity 超越了這一點，默認情況下隱藏此類信息，隱藏/proc 中內核提供的其他敏感信息源，並隱藏專用網路 -所有使用者的相關資訊。網路資訊不僅侵犯了系統上其他使用者的隱私，而且在過去對於 TCP 劫持攻擊也很有用。

Answer

一種可能性是使用或來/proc安裝。此掛載選項已添加到後來的 Linux 核心中，並在 CentOS 5.9 和 6.3 周圍的某個時間向後移植。 hidepid=1hidepid=2

Mount options
   The proc filesystem supports the following mount options:

   hidepid=n (since Linux 3.3)
          This option controls who can access the information in
          /proc/[pid] directories.  The argument, n, is one of the
          following values:

          0   Everybody may access all /proc/[pid] directories.  This is
              the traditional behavior, and the default if this mount
              option is not specified.

          1   Users may not access files and subdirectories inside any
              /proc/[pid] directories but their own (the /proc/[pid]
              directories themselves remain visible).  Sensitive files
              such as /proc/[pid]/cmdline and /proc/[pid]/status are now
              protected against other users.  This makes it impossible
              to learn whether any user is running a specific program
              (so long as the program doesn't otherwise reveal itself by
              its behavior).

          2   As for mode 1, but in addition the /proc/[pid] directories
              belonging to other users become invisible.  This means
              that /proc/[pid] entries can no longer be used to discover
              the PIDs on the system.  This doesn't hide the fact that a
              process with a specific PID value exists (it can be
              learned by other means, for example, by "kill -0 $PID"),
              but it hides a process's UID and GID, which could
              otherwise be learned by employing stat(2) on a /proc/[pid]
              directory.  This greatly complicates an attacker's task of
              gathering information about running processes (e.g.,
              discovering whether some daemon is running with elevated
              privileges, whether another user is running some sensitive
              program, whether other users are running any program at
              all, and so on).

另一種可能性（由發布者發現並添加到此答案作為參考資訊）是網路安全它具有向非特權用戶隱藏其他用戶進程的功能，作為其一部分文件系統強化。

為非特權使用者隱藏其他使用者的進程

雖然上游核心現在為/proc 提供了一個掛載選項來隱藏其他非特權用戶的進程，但grsecurity 超越了這一點，默認情況下隱藏此類信息，隱藏/proc 中內核提供的其他敏感信息源，並隱藏專用網路 -所有使用者的相關資訊。網路資訊不僅侵犯了系統上其他使用者的隱私，而且在過去對於 TCP 劫持攻擊也很有用。

Question 2

根據以下帖子中的信息，我確定了 3 種可能的解決方案。

htop 只顯示運行它的使用者的進程？在 Unix 和 Linux 上
https://www.centos.org/forums/viewtopic.php?f=14&t=52563

其中指出 grsecurety 可能會導致用戶無法看到其他用戶的 pid，/proc/並且 OVH（我的託管公司）使用使用 Grsecurity 編譯的自訂內核

$ uname -r
3.14.32-xxxx-grs-ipv6-64

可能的解決方案是：

刪除安全性
編輯策略以允許此類使用
確保其他管理員了解新的安全措施

對我來說，教育其他管理員是最好的選擇，因為安全是第一位的。不過還是有點希望他們能告訴我們這樣的事情。謝謝你的幫忙！

Answer