top 仅显示当前用户进程

Question 1

一种可能性是使用或/proc进行挂载。此挂载选项是在后期的 Linux 内核中添加的，并在 CentOS 5.9 和 6.3 左右移植回来。 hidepid=1hidepid=2

Mount options
   The proc filesystem supports the following mount options:

   hidepid=n (since Linux 3.3)
          This option controls who can access the information in
          /proc/[pid] directories.  The argument, n, is one of the
          following values:

          0   Everybody may access all /proc/[pid] directories.  This is
              the traditional behavior, and the default if this mount
              option is not specified.

          1   Users may not access files and subdirectories inside any
              /proc/[pid] directories but their own (the /proc/[pid]
              directories themselves remain visible).  Sensitive files
              such as /proc/[pid]/cmdline and /proc/[pid]/status are now
              protected against other users.  This makes it impossible
              to learn whether any user is running a specific program
              (so long as the program doesn't otherwise reveal itself by
              its behavior).

          2   As for mode 1, but in addition the /proc/[pid] directories
              belonging to other users become invisible.  This means
              that /proc/[pid] entries can no longer be used to discover
              the PIDs on the system.  This doesn't hide the fact that a
              process with a specific PID value exists (it can be
              learned by other means, for example, by "kill -0 $PID"),
              but it hides a process's UID and GID, which could
              otherwise be learned by employing stat(2) on a /proc/[pid]
              directory.  This greatly complicates an attacker's task of
              gathering information about running processes (e.g.,
              discovering whether some daemon is running with elevated
              privileges, whether another user is running some sensitive
              program, whether other users are running any program at
              all, and so on).

另一种可能性（由发帖人发现并添加到此答案中作为参考信息）是grsecurity它具有向非特权用户隐藏其他用户进程的功能文件系统强化。

对非特权用户隐藏其他用户的进程

虽然上游内核现在为 /proc 提供了一个挂载选项来隐藏其他非特权用户的进程，但 grsecurity 更进一步，默认隐藏此类信息，隐藏内核在 /proc 中提供的其他敏感信息源，并隐藏所有用户的私有网络相关信息。网络信息不仅侵犯了系统上其他用户的隐私，而且在过去也曾被用于 TCP 劫持攻击。

Answer

一种可能性是使用或/proc进行挂载。此挂载选项是在后期的 Linux 内核中添加的，并在 CentOS 5.9 和 6.3 左右移植回来。 hidepid=1hidepid=2

Mount options
   The proc filesystem supports the following mount options:

   hidepid=n (since Linux 3.3)
          This option controls who can access the information in
          /proc/[pid] directories.  The argument, n, is one of the
          following values:

          0   Everybody may access all /proc/[pid] directories.  This is
              the traditional behavior, and the default if this mount
              option is not specified.

          1   Users may not access files and subdirectories inside any
              /proc/[pid] directories but their own (the /proc/[pid]
              directories themselves remain visible).  Sensitive files
              such as /proc/[pid]/cmdline and /proc/[pid]/status are now
              protected against other users.  This makes it impossible
              to learn whether any user is running a specific program
              (so long as the program doesn't otherwise reveal itself by
              its behavior).

          2   As for mode 1, but in addition the /proc/[pid] directories
              belonging to other users become invisible.  This means
              that /proc/[pid] entries can no longer be used to discover
              the PIDs on the system.  This doesn't hide the fact that a
              process with a specific PID value exists (it can be
              learned by other means, for example, by "kill -0 $PID"),
              but it hides a process's UID and GID, which could
              otherwise be learned by employing stat(2) on a /proc/[pid]
              directory.  This greatly complicates an attacker's task of
              gathering information about running processes (e.g.,
              discovering whether some daemon is running with elevated
              privileges, whether another user is running some sensitive
              program, whether other users are running any program at
              all, and so on).

另一种可能性（由发帖人发现并添加到此答案中作为参考信息）是grsecurity它具有向非特权用户隐藏其他用户进程的功能文件系统强化。

对非特权用户隐藏其他用户的进程

虽然上游内核现在为 /proc 提供了一个挂载选项来隐藏其他非特权用户的进程，但 grsecurity 更进一步，默认隐藏此类信息，隐藏内核在 /proc 中提供的其他敏感信息源，并隐藏所有用户的私有网络相关信息。网络信息不仅侵犯了系统上其他用户的隐私，而且在过去也曾被用于 TCP 劫持攻击。

Question 2

根据以下帖子中的信息，我确定了 3 种可能的解决方案。

htop 仅显示运行它的用户的进程？在 Unix 和 Linux 上
https://www.centos.org/forums/viewtopic.php?f=14&t=52563

这表明 grsecurty 会导致用户无法看到其他用户的 pid，/proc/并且 OVH（我的托管公司）使用 Grsecurity 编译的自定义内核

$ uname -r
3.14.32-xxxx-grs-ipv6-64

可能的解决方案是：

删除 grsecurity
编辑政策以允许此类使用
确保其他管理员了解已实施的新安全措施

对我来说，教育其他管理员是最好的选择，因为安全是第一位的。不过还是希望他们能通知我们这样的事情。谢谢你们的帮助！

Answer