Fix: Keep credentials out of the process list and the log output - #1384
Open
TheBeast85 wants to merge 1 commit into
Open
Fix: Keep credentials out of the process list and the log output#1384TheBeast85 wants to merge 1 commit into
TheBeast85 wants to merge 1 commit into
Conversation
A password passed as --gmp-password or --ssh-password is readable by every other user of the machine while the process runs, via ps and /proc/<pid>/cmdline on Linux and via the task manager and Win32_Process.CommandLine on Windows. The user name is exposed the same way. - Add gvmtools/secrets.py, which overwrites the credentials in the command line of the running process once the arguments have been parsed. On Linux the argument vector is located through /proc/self/stat, on Windows the command line is rewritten in the process environment block. - Redact credentials from all log records by wrapping the log record factory. This also covers the "Parsed arguments" line, which used to write the password to the log file with --log DEBUG, and the <username> and <password> elements of GMP requests. - Stop printing the default of the credential options in --help. The default may come from the configuration file, which put its password into the help output. - Add --gmp-password-file, --ssh-password-file, --gmp-password-prompt, --ssh-password-prompt and the environment variables GVMTOOLS_GMP_PASSWORD and GVMTOOLS_SSH_PASSWORD as ways to pass a password that never reaches the command line.
greenbonebot
enabled auto-merge (rebase)
August 3, 2026 11:52
Conventional Commits Report
🚀 Conventional commits found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
/proc/self/staton Linux, process environment block on Windows), in a newgvmtools/secrets.py.Parsed argumentsline, which wrote the password to the log file with--log DEBUG, and the<username>/<password>elements of GMP requests.%(default)rfor the credential options in--help, which printed the password from the config file.--gmp-password-file,--ssh-password-file,--gmp-password-prompt,--ssh-password-promptandGVMTOOLS_GMP_PASSWORD/GVMTOOLS_SSH_PASSWORD.Why
--gmp-passwordand--ssh-passwordare readable by any other user of the machine while the process runs, throughpsand/proc/<pid>/cmdlineon Linux and through the task manager andWin32_Process.CommandLineon Windows. The user name is exposed the same way. The existing options keep working, they just no longer stay visible; the new options avoid the exposure altogether.Two limits, documented in
docs/credentials.md: about a tenth of a second passes between process start and argument parsing, and the shell history is written by the shell.References
None.
Checklist
docs/credentials.md)