0

Suppose that, at time (1), I create a named pipe using Python with the goal that eventually this Python process would write something to that named pipe. Why? Because, at time (2), there is another process that is expected to read from that named pipe.

So, basically, it's IPC via named pipes. Why is this neat? Because it looks like a file, so that the other process that can only read files, can be communicated to via this named pipe mechanism as a convenient IPC without needing to rewrite the other process.

But there is a problem: suppose that between time (1) and time (2), an evil process started reading from the named pipe 1st before that intended process. This way, my Python script may end up sending data to an unintended process. So I am not concerned if the hijacker starts writing to the process in my specific risk model (I'm only concerned about the hijacking reading from the pipe before the intended process).

Question: is there any mechanism to ensure no other process but the intended one reads from the IPC other than the intended process?

1

Named pipes have file permissions just like any other file. Make sure that when you crete the pipe, the permissions are set such that only the account meant to run your process can read from it.

3
  • Can we make it without tinkering with permissions? How about this answer: stackoverflow.com/a/55345514/5810023 ? Does communication via PTY as done there prevent man-in-middle attacks such as the scenario that I mentioned?
    – caveman
    Aug 12 '20 at 5:14
  • @caveman Is your question about that SO Q/A or is it as originally stated, i.e. "is there any mechanism to ensure no other process but the intended one reads from the IPC other than the intended process?"?
    – Kusalananda
    Aug 12 '20 at 5:30
  • As originally stated, but I'm flexible. Because the other process also reads via password prompt.
    – caveman
    Aug 12 '20 at 5:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.