diff --git a/nixos/doc/manual/release-notes/rl-2105.xml b/nixos/doc/manual/release-notes/rl-2105.xml
index ca4b468e355f..302a6d3f3749 100644
--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@@ -100,6 +100,12 @@
Assigning custom names section
of the NixOS manual for an example using networkd links.
+
+
+
+ The module has been removed.
+ It was broken since the switch to cgroups-v2.
+
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 644229627b2f..f831e302b161 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -207,7 +207,6 @@
./security/dhparams.nix
./security/duosec.nix
./security/google_oslogin.nix
- ./security/hidepid.nix
./security/lock-kernel-modules.nix
./security/misc.nix
./security/oath.nix
diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix
index 680fa40b9119..00aafc6831b2 100644
--- a/nixos/modules/profiles/hardened.nix
+++ b/nixos/modules/profiles/hardened.nix
@@ -22,8 +22,6 @@ with lib;
environment.memoryAllocator.provider = mkDefault "scudo";
environment.variables.SCUDO_OPTIONS = mkDefault "ZeroContents=1";
- security.hideProcessInformation = mkDefault true;
-
security.lockKernelModules = mkDefault true;
security.protectKernelImage = mkDefault true;
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 2d07e421efe4..9f1efc462798 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -73,6 +73,11 @@ with lib;
(mkRemovedOptionModule [ "services" "venus" ] "The corresponding package was removed from nixpkgs.")
(mkRemovedOptionModule [ "services" "flashpolicyd" ] "The flashpolicyd module has been removed. Adobe Flash Player is deprecated.")
+ (mkRemovedOptionModule [ "security" "hideProcessInformation" ] ''
+ The hidepid module was removed, since the underlying machinery
+ is broken when using cgroups-v2.
+ '')
+
# Do NOT add any option renames here, see top of the file
];
}
diff --git a/nixos/modules/security/hidepid.nix b/nixos/modules/security/hidepid.nix
deleted file mode 100644
index 4953f517e93b..000000000000
--- a/nixos/modules/security/hidepid.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ config, lib, ... }:
-with lib;
-
-{
- meta = {
- maintainers = [ maintainers.joachifm ];
- doc = ./hidepid.xml;
- };
-
- options = {
- security.hideProcessInformation = mkOption {
- type = types.bool;
- default = false;
- description = ''
- Restrict process information to the owning user.
- '';
- };
- };
-
- config = mkIf config.security.hideProcessInformation {
- users.groups.proc.gid = config.ids.gids.proc;
- users.groups.proc.members = [ "polkituser" ];
-
- boot.specialFileSystems."/proc".options = [ "hidepid=2" "gid=${toString config.ids.gids.proc}" ];
- systemd.services.systemd-logind.serviceConfig.SupplementaryGroups = [ "proc" ];
-
- # Disable cgroupsv2, which doesn't work with hidepid.
- # https://github.com/NixOS/nixpkgs/pull/104094#issuecomment-729996203
- systemd.enableUnifiedCgroupHierarchy = false;
- };
-}
diff --git a/nixos/modules/security/hidepid.xml b/nixos/modules/security/hidepid.xml
deleted file mode 100644
index 5a17cb1da412..000000000000
--- a/nixos/modules/security/hidepid.xml
+++ /dev/null
@@ -1,28 +0,0 @@
-
- Hiding process information
-
- Setting
-
- = true;
-
- ensures that access to process information is restricted to the owning user.
- This implies, among other things, that command-line arguments remain private.
- Unless your deployment relies on unprivileged users being able to inspect the
- process information of other users, this option should be safe to enable.
-
-
- Members of the proc group are exempt from process
- information hiding.
-
-
- To allow a service foo to run without process
- information hiding, set
-
-systemd.services.foo.serviceConfig.SupplementaryGroups = [ "proc" ];
-
-
-
diff --git a/nixos/tests/hardened.nix b/nixos/tests/hardened.nix
index 0c26eaa310d4..485efc0fb78c 100644
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@@ -65,17 +65,6 @@ import ./make-test-python.nix ({ pkgs, latestKernel ? false, ... } : {
machine.succeed("grep -Fq wireguard /proc/modules")
- # Test hidepid
- with subtest("hidepid=2 option is applied and works"):
- # Linux >= 5.8 shows "invisible"
- machine.succeed(
- "grep -Fq hidepid=2 /proc/mounts || grep -Fq hidepid=invisible /proc/mounts"
- )
- # cannot use pgrep -u here, it segfaults when access to process info is denied
- machine.succeed("[ `su - sybil -c 'ps --no-headers --user root | wc -l'` = 0 ]")
- machine.succeed("[ `su - alice -c 'ps --no-headers --user root | wc -l'` != 0 ]")
-
-
# Test kernel module hardening
with subtest("No more kernel modules can be loaded"):
# note: this better a be module we normally wouldn't load ...