UidSEC LSM

This module extends the standard UN*X "resource protection" model adding some features useful for untrusted multiuser systems

Current features

Deny usage of dmesg to unprivileged users

Hide processes of "other users" to unprivileged users (example: sam can only see his processes during a 'top' or a 'ps aux')

Deny access to /sys and /config to unprivileged users

Protect usage of bind() syscall using UidBIND

Assign a group that can use dmesg and see all system processes

You can download uidsec module from here:
uidsec-lsm-0.1.tar.gz

You need (obviously) the LSM framework and (if you want bind() protection) a system with configfs enabled:

	root@hell: modprobe configfs
	root@hell: mount -t configfs none /config