We have a CI server application run as the build user.  Any command with arguments run by the CI server is visible via ps. Although non-admin users do not have access to load a shell on the CI server, they do however have access to running unix commands via a task. My concern is; user A can potentially expose a user B's task which has command line arguments (which could potentially be sensitive info) by simply doing a ps.Note that all tasks within the CI server is run as the build user. Users cannot switch to different user.I could perhaps block the ps command so within a task a user cannot execute ps, which should solve my problem however I'm curious to know:Are there other commands that can be run to expose command line arguments without having root privileges?Given the context of this problem, is there a better/secure way to manage it?
How to stop a user from seeing command line arguments?
command line;security;users;ps;arguments
I'm afraid all commands are run as the build user.Then anybody who submits a build can see, and even interfere, with the jobs of another user. Running a build can execute arbitrary code; this allows anybody who submits a build not only to run ps but also to read and write files belonging to other jobs. If you can't trust the users who submit builds then you must run the builds as separate users.If you're concerned only with users who have an account on that CI server but aren't allowed to submit builds, then the hidepid option may help you. Alternatively, educate build submitters to pass confidential information in files or environment variables instead of command line arguments. Note that the ps command isn't what you need to take care of, it's just a pretty-printer for information found in the proc filesystem. The command line of process 1234 can be printed with cat /proc/1234/cmdline.If you have confidentiality concerns with builds, I recommend that rather than attempting to plug one potential information leak at a time, you run all builds in a container or virtual machine.