I have a simple script that reads user's input (password) and save it to a variable

read -s -p "password: " PASSWD; printf "%b" "\n" 

Apparently this is not secure as it's stored in a clear text in memory and it's possible to access it via core dump? How I can read this variable from the memory. Please note that I'm not looking for a better solution I'm just curious if I can actually read this password/variable.


root can always (for nearly all values of always) read process memory so it will be possible to extract that, no matter how it's stored (there is always a tiny window even if the password gets sent to a secure storage device such as smartcard, iButton or TPM hardware).

In your example, PASSWD will be stored in a local variable. Environment variables to the process are stored in /proc/PID/environ and can be read by that user or root:

[choad ~]$ read -s -p "password: " PASSWD; echo
[choad ~]$ echo $PASSWD
[choad ~]$ ls -al /proc/self/environ
-r-------- 1 michael michael 0 May  6 14:46 /proc/self/environ
[choad ~]$ grep PASSWD /proc/self/environ
[choad ~]$ export PASSWD
[choad ~]$ tr '\000' '\n' < /proc/self/environ | grep PASSWD
[choad ~]$ echo $$

[choad ~]$ gdb -p 19613
(gdb) info proc mappings
     0x91f2000  0x9540000   0x34e000          0           [heap]
(gdb) dump memory /tmp/bash.mem 0x91f2000 0x9540000

[choat ~]$ strings /tmp/bash.mem |grep ^PASSWD

N.B.: some distributions enable Yama's ptrace_scope restrictions which prevent attaching to arbitrary processes owned by the same user.

N.B.: Be most wary of passing passwords around via a command line. Nothing should be passed as an argument that the whole world can't know about. The command line is not protected.

| improve this answer | |
  • I disagree with the point of /proc/PID/environ. That happens only if the variables is actually exported, as you do it in your script. If it isn't, the job is harder than just that. – glglgl May 6 '12 at 22:03
  • That's why I explicitly said 'Environment Variables' there. – MikeyB May 7 '12 at 3:41

It is not easy to access a memory region of another process under operating systems that implement memory protection.

If you have a doubt that another process/user will try that, you can make use of this variable and then immediately empty it after that. You can also try to store a hashed copy of the password if that works in your case.

| improve this answer | |

One way, or another, the password will have to stay in memory for you to use it (you can store some AES passwords in the CPU, i forgot how the technology is called, but otherwise, either it's in the memory, or you prompt the user every time to reenter it and then wipe it).

If you want to dump your whole memory, you can use memdump, but watch out, since writing it to disk uses memory too, so you might be overwriting it before you dump that part :) (Of course, if your script/program is still running, that part of the memory is stil 'used', so it wont get overwritten)

You can then try grepping the dump for your password, and it will be there (probably more then once). Finding out where the password is stored (and what it is), if you don't know it, is a lot harder task.

You can also try reading this - the page seems to be down at the moment, but google still has it cached.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.