don't expose secstore secrets in /mnt/term/dev/secstore

this feature is too dangerous. i can imagine it being there so a server side factotum can use the drawterms secstore keys that it already loaded, but this makes it just too easy to steal the keys. now we zero the secstorebuf after we extracted the plan9 key from it so no secrets are left behind in drawterms memory after authentication is done.

cinap_lenrek committed 10 years ago

Commit 39347ab1 parent 162ce8d3 files · +3 −21Browse files

Unified · Split

3 files

cpu.c +2 −0
kern/devcons.c +0 −21
main.c +1 −0

cpu.c+2−0

@@ -637,6 +637,8 @@ p9any(int fd) · 636 unmodified lines
637	637
638	638	u = user;
639	639	pass = findkey(&u, tr.authdom, proto);
	640	+ memset(secstorebuf, 0, sizeof(secstorebuf)); /* forget secstore secrets */
	641	+
640	642	if(pass == nil)
641	643	again:
642	644	pass = getkey(u, tr.authdom, proto);

kern/devcons.c+0−21

@@ -464,7 +464,6 @@ enum{ · 463 unmodified lines
464	464	Qppid,
465	465	Qrandom,
466	466	Qreboot,
467		− Qsecstore,
468	467	Qshowfile,
469	468	Qsnarf,
470	469	Qswap,
@@ -498,7 +497,6 @@ static Dirtab consdir[]={ · 27 unmodified lines
498	497	"ppid", {Qppid}, NUMSIZE, 0444,
499	498	"random", {Qrandom}, 0, 0444,
500	499	"reboot", {Qreboot}, 0, 0664,
501		− "secstore", {Qsecstore}, 0, 0666,
502	500	"showfile", {Qshowfile}, 0, 0220,
503	501	"snarf", {Qsnarf}, 0, 0666,
504	502	"swap", {Qswap}, 0, 0664,
@@ -509,8 +507,6 @@ static Dirtab consdir[]={ · 4 unmodified lines
509	507	"zero", {Qzero}, 0, 0444,
510	508	};
511	509
512		−char secstorebuf[65536];
513		−Dirtab *secstoretab = &consdir[Qsecstore];
514	510	Dirtab *snarftab = &consdir[Qsnarf];
515	511
516	512	int
@@ -605,13 +601,6 @@ consopen(Chan *c, int omode) · 88 unmodified lines
605	601	c->iounit = qiomaxatomic;
606	602	break;
607	603
608		− case Qsecstore:
609		− if(omode == ORDWR)
610		− error(Eperm);
611		− if(omode != OREAD)
612		− memset(secstorebuf, 0, sizeof secstorebuf);
613		− break;
614		−
615	604	case Qsnarf:
616	605	if(omode == ORDWR)
617	606	error(Eperm);
@@ -765,9 +754,6 @@ consread(Chan c, void buf, long n, vlong off) · 147 unmodified lines
765	754	return 0;
766	755	return readstr(offset, buf, n, c->aux);
767	756
768		− case Qsecstore:
769		− return readstr(offset, buf, n, secstorebuf);
770		−
771	757	case Qsysstat:
772	758	return 0;
773	759
@@ -915,13 +901,6 @@ conswrite(Chan c, void va, long n, vlong off) · 141 unmodified lines
915	901	free(cb);
916	902	break;
917	903
918		− case Qsecstore:
919		− if(offset >= sizeof secstorebuf \|\| offset+n+1 >= sizeof secstorebuf)
920		− error(Etoobig);
921		− secstoretab->qid.vers++;
922		− memmove(secstorebuf+offset, va, n);
923		− return n;
924		−
925	904	case Qshowfile:
926	905	return showfilewrite(a, n);
927	906

main.c+1−0

@@ -8,6 +8,7 @@ · 7 unmodified lines
8	8
9	9	char *argv0;
10	10	char *user;
	11	+char secstorebuf[65536];
11	12
12	13	extern int errfmt(Fmt*);
13	14	void

don't expose secstore secrets in /mnt/term/dev/secstore

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code