Re: How best to hide command-line arguments from ps command?

[hanenkamp]

Not necessarily. For example, under Linux with a /proc filesystem: I just have to browse to /proc/<pid>/environ and look at it--of course, I would still need the correct permissions to read the environ pseudo-file. In any case, I wouldn't consider this safe since the environment isn't really a secure store.

You can turn off echo on the tty in Perl just as easily as with stty:

use Term::Readkey;

ReadMode "noecho";
$password = <STDIN>;
ReadMode "restore";

[etcshadow]

Well, the permissions that you would need to pull that off (reading another user's environment from the /proc filesystem) are root permissions, and you've got to assume that absolutely anything you do can be evesdropped on by root, anyway.

There's two classes of people that you can't avoid trusting (implicitly or explicitly):

• root user (or anyone able to assume root)
• anyone who has physical access to your machine
They can see and interfere with anything you do. Granted, it may be very hard to pull off, but it can be done. This is why access control and physical security cannot be overemphasized.

[sgifford]

Not all versions of Unix hide the contents of a user's environment from other users. On Solaris, for example, /usr/ucb/ps -augxwwwe will show you other users' processes' environment variables.

[etcshadow]

Interesting... even when not run as root, and the process belongs to another user? I mean... on linux, ps can list environment, but only of processes which the executing user has privelege over. And the reason, fundamentally, is that the O/S just doesn't give out that information. The /proc filesystem and the ps command are just different means of accessing it.

I guess one thing that could explain that is if the ps binary was setuid root. But that would indicate frighteningly bad systems administration.

I'd actually be kind of surprised (but I could believe still it) that solaris has less security partitioning than linux.