3b38efe ipa tools: remove sensitive material from the commandline

12 files Authored by abbra 2 months ago, Committed by antorres 2 months ago,
    ipa tools: remove sensitive material from the commandline
    
    When command line tools accept passwords, remove them from the command
    line so that they don't get visible in '/proc/pid/commandline'.
    
    There is no common method to access the original ARGV vector and modify
    it from Python. Since this mostly affects Linux systems where IPA
    services run, we expect use of GNU libc and thus can rely on internal
    glibc symbols. If they aren't available, the code will skip removing
    passwords.
    
    Fixes: CVE-2024-11029
    
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    
        
file modified
+40 -0