From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Glenn Morris Newsgroups: gmane.emacs.bugs Subject: bug#8427: [SECURITY] sql.el -- comint process passwords are leaked to ps(1) listing Date: Wed, 05 Mar 2014 21:06:16 -0500 Message-ID: <2swqg8rsh3.fsf@fencepost.gnu.org> References: <87fwpxdjlk.fsf@blue.sea.net> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1394071620 27365 80.91.229.3 (6 Mar 2014 02:07:00 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Thu, 6 Mar 2014 02:07:00 +0000 (UTC) To: 8427@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Thu Mar 06 03:07:09 2014 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1WLNiH-0008Rc-AI for geb-bug-gnu-emacs@m.gmane.org; Thu, 06 Mar 2014 03:07:09 +0100 Original-Received: from localhost ([::1]:55373 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WLNiG-0005lg-R5 for geb-bug-gnu-emacs@m.gmane.org; Wed, 05 Mar 2014 21:07:08 -0500 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:50608) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WLNiC-0005lH-5d for bug-gnu-emacs@gnu.org; Wed, 05 Mar 2014 21:07:05 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WLNiA-0004aN-Mc for bug-gnu-emacs@gnu.org; Wed, 05 Mar 2014 21:07:04 -0500 Original-Received: from debbugs.gnu.org ([140.186.70.43]:51007) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WLNiA-0004aJ-JD for bug-gnu-emacs@gnu.org; Wed, 05 Mar 2014 21:07:02 -0500 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.80) (envelope-from ) id 1WLNiA-0003tV-8o for bug-gnu-emacs@gnu.org; Wed, 05 Mar 2014 21:07:02 -0500 X-Loop: help-debbugs@gnu.org Resent-From: Glenn Morris Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Thu, 06 Mar 2014 02:07:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 8427 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: security Original-Received: via spool by 8427-submit@debbugs.gnu.org id=B8427.139407158014893 (code B ref 8427); Thu, 06 Mar 2014 02:07:02 +0000 Original-Received: (at 8427) by debbugs.gnu.org; 6 Mar 2014 02:06:20 +0000 Original-Received: from localhost ([127.0.0.1]:52186 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1WLNhT-0003s8-GU for submit@debbugs.gnu.org; Wed, 05 Mar 2014 21:06:19 -0500 Original-Received: from fencepost.gnu.org ([208.118.235.10]:52055) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1WLNhR-0003ry-D3 for 8427@debbugs.gnu.org; Wed, 05 Mar 2014 21:06:18 -0500 Original-Received: from rgm by fencepost.gnu.org with local (Exim 4.71) (envelope-from ) id 1WLNhQ-0000j3-98; Wed, 05 Mar 2014 21:06:16 -0500 X-Spook: NSA data haven offensive information warfare JPL Jiang X-Ran: F;RJI:_;}hEgZQPn-8D51dS>t2\LOletfRnw7q]<8mG-8tVpwI-g~.i0vu86|NuqcU\4w9 X-Hue: red X-Attribution: GM In-Reply-To: <87fwpxdjlk.fsf@blue.sea.net> (Jari Aalto's message of "Tue, 05 Apr 2011 14:27:03 +0300") User-Agent: Gnus (www.gnus.org), GNU Emacs (www.gnu.org/software/emacs/) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 140.186.70.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:86592 Archived-At: Jari Aalto wrote: > There is a big security problem with sql.el: > > M-x sql-mysql > > > At command line, anyone in multi-user environment can dig out the > passwords: > > $ ps -ef -o user,pid,args | grep mysql # ps(1) under SUN/Solaris > foo 9599 /usr/local/bin/mysql --user=foo --password=123456 --host=db.example.com > bar 3732 /usr/local/bin/mysql --user=bar --password=abcdef --host=db.example.com Apparently, no they cannot, since mysql replaces the password characters with x's: http://www.lenzg.net/archives/256-basic-mysql-security-providing-passwords-on-the-command-line.html I tested it and it is so hidden for me. Also, with recent Linux kernels, you can enable the procfs "hidepid" feature to prevent this entire class of information leakage. So I don't think Emacs needs to do anything but maybe add a warning statement to the doc string. Downgrading bug severity accordingly.