gpg-agent: Show PID/command line of the requesting process
wavexx at thregr.org
Tue Dec 23 18:56:58 CET 2014
When using gpg-agent in daemon mode it's not always obvious which
process is requesting authorization for unlocking a key. The agent
should always show the PID/command of the requester.
I filed a bug report at Debian:
and I also decided to give it a try in implementing the fix.
In the attached patch I have the first crude proposal:
- A new struct is introduced in the main context, adding the PID and the
command line of the requesting process.
- As soon as the connection is established, the fields are populated.
Of note here, is that libassuan does have PID/gid/uid information
already (Using various forms of SO_PEERCRED/getpeercred/etc), but it's
established only later in the individual handlers once an assuan context
is created. Since I'm aiming to make at least the PID *mandatory*, I
think it's useless to perform this task for each handler. It's also true
that copying the entire #ifdef block from libassuan is bad as well...
The command line is extracted from /proc/[pid]/cmdline. Does somebody
know if BSDs have something equivalent? If not, inserting the path of
the executable associated with the PID would be the way to go.
- When constructing the description for the ssh daemon, the PID/process
is also shown in the text.
- The modifiers %p/%P are introduced to insert the PID and command line
into the prompt.
When unlocking a secret key through the normal handler though, the
prompt is generated by the calling process.
It would make sense to me, similarly as done for SSH, that a minimum
description (pid/program/key/operation) must be inserted by the agent
itself, and not by the calling process (which could be easily faked).
Having a fixed text would be easy (such as: Program [PID] [command] is
requesting to unlock the secret key ...). While doing some tests, it
seems to me that I don't lose anything by ignoring completely gpg's prompts.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 7865 bytes
Desc: not available
More information about the Gnupg-devel