Restrict Hardware Information to Root - Testers Wanted!

[madaidan]

VMs don’t hide all hardware information and it doesn’t hide the CPU model.

See Protocol Leak and Fingerprinting Protection‎ and Restrict hardware information to root

@SokPuppette

And if you don’t do that, it’s probably pretty pointless to hide /proc/cpuinfo because a user mode program can probably detect most of it anyhow.

It can’t. I’ve tested it. Those programs will fallback to /sys which is also restricted.

@SokPuppette

there shouldn’t be much if anything to find in /sys either.

There are tons of hardware, kernel, debug info etc. in /sys. /sys is especially problematic and has been the cause of many infoleaks such as kernel pointer leaks.

@SokPuppette

Nothing inside the VM should be trusted with any of that hardware information, root or not

AppArmor for Complete System - Including init, PID1, Systemd, Everything! - Full System MAC policy can do that assuming no kernel compromise.