ProcSubset setting
The property ProcSubset is a systemd unit setting used for sandboxing. It is available since systemd 247.
Purpose: define the subset of access by unit to /proc
Why and when to use ProcSubset
The setting ProcSubset controls the “subset” mount option of /proc for the unit.
Caveats
This function does not if the “subnet” option for procfs is not supported.
Generic advice
The Linux kernel shares information from various kernel APIs via /proc. When activating this setting, these kernel APIs are also made unavailable, which might break common software, unless it is a trivial process. So this option is to be used with care. Typically it may be better to implement the ProtectProc setting.
Values
Systemd unit setting ProcSubset expects a boolean (yes/no or true/false) or string value.
| Value | Intended action | Available since systemd version |
|---|---|---|
| all | no restriction of information from /proc - default | |
| pid | restricts information from /proc that not directly associated with process management and introspection |
Example to show the current value of ProcSubset for the ssh service:
systemctl show --property=ProcSubset ssh.serviceRelated hardening profiles
The systemd unit setting ProcSubset is used in the following hardening profiles.
