As it happens I have been working on a similar problem myself recently.

The approaches I considered where to pass the password as and environment variable, or to pipe it to the child process on it's stdin.

Both are a bit more secure than a plain argument on the command line, but neither is that secure. For example on linux you can read the environment variables of any process by reading /proc/<pid>environ (Try: hexdump /proc/$$/environ -C to read the environment of your shell). Data piped thru stdin on the child is probably a bit more secure, as it is transient, but I dare say there would be a way for an attacker to read it.

The bottom line is that if an attacker already has root on the destination box, and is prepared to put some time into it, he can subvert any security scheme you can come up with, so what you need to do is come up with a threat model and work out what kind of attacker you need to defend against. How clever are they? What privileges do they have on the box?

In reply to Re: Passing a password to another process "safely" in Linux by chrestomanci
in thread Passing a password to another process "safely" in Linux by rastoboy

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.