I wanted to write a daemon that users can start, and that, every 2 hours, automatically mounts an authenticated network share. The daemon will prompt the user for the password only the first time, and it will keep it mlock()
ed then.
My idea was to somehow call the linux program mount(1)
(manpage notation). The protocol for the mounting (in my case samba) only allows to give the password via the mount options -o
[1]. However, passing the password as a parameter to a shell script makes it visible in the ps-table.
Then, I found out that there's a linux system call mount(2)
that takes the same parameters. Is it safe to simply pass the password as plaintext to mount(2)
's parameters?
Things I worry about:
mount(2)
might be implemented by calling a process where it passes the arguments, including the password. This would leave the password in the ps-table. However, I think system calls won't do that?mount(2)
might have its parameters in non-mlock()
ed memory, e.g. if the system swaps, the plaintext password is readable on disk. I don't know if a system-calls memory can be swapped, but since the mount call is only active for a short time, I guess this is no real issue.mount(2)
might (maybe depending on the file system type) print error or log messages exposing its parameters. (e.g. in system files like/var/log/messages
or thedmesg
output). At least, I just testedmount(2)
with theMS_SILENT
flag and did not find any system logs, even on failure.
All in all, how safe is my solution?
Notes: [1] Samba also allows plaintext authentication files or typing the password at a prompt, but that was not useful in my case.