I noticed some time ago that usernames and passwords given to
curl as command line arguments don't appear in
ps output (although of course they may appear in your bash history).
They likewise don't appear in
(The length of the combined username/password argument can be derived, though.)
[root@localhost ~]# nc -l 80 &  3342 [root@localhost ~]# curl -u iamsam:samiam localhost &  3343 [root@localhost ~]# GET / HTTP/1.1 Authorization: Basic aWFtc2FtOnNhbWlhbQ== User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.15.3 zlib/1.2.3 libidn/1.18 libssh2/1.4.2 Host: localhost Accept: */* + Stopped nc -l 80 [root@localhost ~]# jobs + Stopped nc -l 80 - Running curl -u iamsam:samiam localhost & [root@localhost ~]# ps -ef | grep curl root 3343 3258 0 22:37 pts/1 00:00:00 curl -u localhost root 3347 3258 0 22:38 pts/1 00:00:00 grep curl [root@localhost ~]# od -xa /proc/3343/cmdline 0000000 7563 6c72 2d00 0075 2020 2020 2020 2020 c u r l nul - u nul sp sp sp sp sp sp sp sp 0000020 2020 2020 0020 6f6c 6163 686c 736f 0074 sp sp sp sp sp nul l o c a l h o s t nul 0000040 [root@localhost ~]#
How is this effect achieved? Is it somewhere in the source code of
curl? (I assume it is a
curl feature, not a
ps feature? Or is it a kernel feature of some sort?)
Also: can this be achieved from outside the source code of a binary executable? E.g. by using shell commands, probably combined with root permissions?
In other words could I somehow mask an argument from appearing in
/proc or in
ps output (same thing, I think) that I passed to some arbitrary shell command? (I would guess the answer to this is "no" but it seems worth including this extra half-a-question.)