diff options
| author | Guido Günther <agx@sigxcpu.org> | 2012-02-26 14:01:40 +0100 |
|---|---|---|
| committer | Guido Günther <agx@sigxcpu.org> | 2012-02-26 18:11:22 +0100 |
| commit | dc228bb35f45ac187b62ffbd50e9bcf7299338e6 (patch) | |
| tree | db37427528187840d50915d0cb3f6a426f0d88d0 /src | |
| parent | a9aaf5f0bbfda0c7b47e93efdb9da5b00284ad10 (diff) | |
Don't send password via environment but via stdin
so it doesn't end up in /proc/<pid>/environ
Diffstat (limited to 'src')
| -rw-r--r-- | src/nm-iodine-service.c | 28 |
1 files changed, 20 insertions, 8 deletions
diff --git a/src/nm-iodine-service.c b/src/nm-iodine-service.c index ead8908..1e3974b 100644 --- a/src/nm-iodine-service.c +++ b/src/nm-iodine-service.c @@ -422,6 +422,22 @@ has_user(const char* user) return (getpwnam(user) == NULL) ? FALSE : TRUE; } + +static void +send_password(gint fd, NMSettingVPN *s_vpn) +{ + const char *passwd; + + passwd = nm_setting_vpn_get_secret (s_vpn, NM_IODINE_KEY_PASSWORD); + /* Don't send an empty password since this makes iodine block */ + if (!passwd || !strlen(passwd)) + passwd = "<none>"; + + write (fd, passwd, strlen(passwd)); + write (fd, "\n", 1); +} + + static gint nm_iodine_start_iodine_binary(NMIODINEPlugin *plugin, NMSettingVPN *s_vpn, @@ -433,7 +449,7 @@ nm_iodine_start_iodine_binary(NMIODINEPlugin *plugin, GSource *iodine_watch; GIOChannel *stderr_channel; gint stdin_fd, stderr_fd; - const char *props_topdomain, *props_fragsize, *props_nameserver, *passwd; + const char *props_topdomain, *props_fragsize, *props_nameserver; /* Find iodine */ iodine_binary = iodine_binary_paths; @@ -458,12 +474,6 @@ nm_iodine_start_iodine_binary(NMIODINEPlugin *plugin, NM_IODINE_KEY_NAMESERVER); props_topdomain = nm_setting_vpn_get_data_item (s_vpn, NM_IODINE_KEY_TOPDOMAIN); - - passwd = nm_setting_vpn_get_secret (s_vpn, NM_IODINE_KEY_PASSWORD); - - if (passwd && strlen(passwd)) - g_setenv("IODINE_PASS", passwd, TRUE); - iodine_argv = g_ptr_array_new (); g_ptr_array_add (iodine_argv, (gpointer) (*iodine_binary)); /* Run in foreground */ @@ -505,7 +515,9 @@ nm_iodine_start_iodine_binary(NMIODINEPlugin *plugin, g_ptr_array_free (iodine_argv, TRUE); g_message ("iodine started with pid %d", pid); - close(stdin_fd); + + send_password (stdin_fd, s_vpn); + close (stdin_fd); stderr_channel = g_io_channel_unix_new (stderr_fd); g_io_add_watch(stderr_channel, |