Swaylock: Clear password buffer after use. #1519
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
After a user enters or clears a password, try to overwrite the buffer containing it. That way it's not sitting around in RAM for something else to read later. Also, mlock() the password buffer so that it is never swapped out. This also replaces the dynamically allocated buffer with a static char[1024]. Any characters past that are discarded until the user hits enter or escape.
ddevault
reviewed
Dec 15, 2017
swaylock/main.c
Outdated
| volatile char *pw = password; | ||
| for (size_t i = 0; i < sizeof(password); ++i) { | ||
| // show_indicator is set at runtime, so compiler can't optimize this out | ||
| pw[i] = show_indicator; |
There was a problem hiding this comment.
I would rather just do
volatile char *pw = password;
volatile char zero = 0;
for (size_t i = ...) {
pw[i] = zero;
}There was a problem hiding this comment.
Oops. That was the code I meant to have in this PR, but I'd forgotten to add -f to my git push.
ggreer
force-pushed
the
clear-password-buffer-0.15
branch
from
3af46eb
to
1312db8
Compare
|
Thanks! |
ggreer
added a commit
to ggreer/sway
that referenced
this pull request
Apr 13, 2018
- Replace char* with static array. Any chars > 1024 will be discarded. - mlock() password buffer so it can't be written to swap. - Clear password buffer after auth succeeds or fails. This is basically the same treatment I gave the 0.15 branch in swaywm#1519
ggreer
added a commit
to ggreer/sway
that referenced
this pull request
Apr 13, 2018
- Replace char* with static array. Any chars > 1024 will be discarded. - mlock() password buffer so it can't be written to swap. - Clear password buffer after auth succeeds or fails. This is basically the same treatment I gave the 0.15 branch in swaywm#1519
ddevault
pushed a commit
to swaywm/swaylock
that referenced
this pull request
Jan 14, 2019
- Replace char* with static array. Any chars > 1024 will be discarded. - mlock() password buffer so it can't be written to swap. - Clear password buffer after auth succeeds or fails. This is basically the same treatment I gave the 0.15 branch in swaywm/sway#1519
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
After a user enters or clears a password, try to overwrite the buffer containing it. That way it's not sitting around in RAM for something else to read later. Also, mlock() the password buffer so that it is never swapped out.
This also replaces the dynamically allocated buffer with a static char[1024]. Any characters past that are discarded until the user hits enter or escape.
I had to close #1513 because I opened it against the wrong base. This PR addresses your comments over there.
Regarding PAM zeroing-out the
strdup()'d password: I figured that out with gdb. Here's a screenshot of my debug session:I'm too lazy to set up debug symbols, and the Linux PAM code is really hard to follow, so I can't link to the exact line where the zeroing happens.
I also used the debugger to verify that swaylock's copy of the password is zeroed-out.