Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
    Tweeted twitter.com/StackUnix/status/895976285897461760
3 edited tags
| link
2 added 104 characters in body
source | link

Also: can this be achieved from outside the source code of a commandbinary executable? In E.g. by using shell commands, probably combined with root permissions?

In other words could I somehow mask an argument from appearing in /proc or in ps output (same thing, I think) that I passed to some arbitrary shell command? (I would guess the answer to this is "no" but it seems worth including the questionthis extra half-a-question.)

Also: can this be achieved from outside the source code of a command? In other words could I somehow mask an argument from appearing in /proc or in ps output (same thing, I think) that I passed to some arbitrary command? (I would guess the answer to this is "no" but it seems worth including the question.)

Also: can this be achieved from outside the source code of a binary executable? E.g. by using shell commands, probably combined with root permissions?

In other words could I somehow mask an argument from appearing in /proc or in ps output (same thing, I think) that I passed to some arbitrary shell command? (I would guess the answer to this is "no" but it seems worth including this extra half-a-question.)

1
source | link

How does curl protect a password from appearing in ps output?

I noticed some time ago that usernames and passwords given to curl as command line arguments don't appear in ps output (although of course they may appear in your bash history).

They likewise don't appear in /proc/PID/cmdline.

(The length of the combined username/password argument can be derived, though.)

Demonstration below:

[root@localhost ~]# nc -l 80 &
[1] 3342
[root@localhost ~]# curl -u iamsam:samiam localhost &
[2] 3343
[root@localhost ~]# GET / HTTP/1.1
Authorization: Basic aWFtc2FtOnNhbWlhbQ==
User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.15.3 zlib/1.2.3 libidn/1.18 libssh2/1.4.2
Host: localhost
Accept: */*



[1]+  Stopped                 nc -l 80
[root@localhost ~]# jobs
[1]+  Stopped                 nc -l 80
[2]-  Running                 curl -u iamsam:samiam localhost &
[root@localhost ~]# ps -ef | grep curl
root      3343  3258  0 22:37 pts/1    00:00:00 curl -u               localhost
root      3347  3258  0 22:38 pts/1    00:00:00 grep curl
[root@localhost ~]# od -xa /proc/3343/cmdline 
0000000    7563    6c72    2d00    0075    2020    2020    2020    2020
          c   u   r   l nul   -   u nul  sp  sp  sp  sp  sp  sp  sp  sp
0000020    2020    2020    0020    6f6c    6163    686c    736f    0074
         sp  sp  sp  sp  sp nul   l   o   c   a   l   h   o   s   t nul
0000040
[root@localhost ~]# 

How is this effect achieved? Is it somewhere in the source code of curl? (I assume it is a curl feature, not a ps feature? Or is it a kernel feature of some sort?)


Also: can this be achieved from outside the source code of a command? In other words could I somehow mask an argument from appearing in /proc or in ps output (same thing, I think) that I passed to some arbitrary command? (I would guess the answer to this is "no" but it seems worth including the question.)