On Sun, 20 May 2007 19:10:33 +0200 Dag-Erling Smørgrav <[EMAIL PROTECTED]> wrote:
> "Zane C.B." <[EMAIL PROTECTED]> writes: > > Dag-Erling Smørgrav <[EMAIL PROTECTED]> writes: > >> Your patch opens a gaping security hole. Sensitive information > >> should never be placed in the environment. > > Unless I am missing something, this is only dangerous if one is > > doing something stupid with what ever is being executed by > > pam_exec. > > Environment variables may be visible to other processes and users > through e.g. /proc. Cool. Forgot about /proc. Is definitely a issue. Hmmm, any ideas in the area of passing it then? My current thoughts are along the lines of passing it through stdin currently.
_______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-security To unsubscribe, send any mail to "[EMAIL PROTECTED]"
