Is it really safe to pass sensitive data to another script via stdin, compared to passing via arguments (Linux)

Question

Yes, the transfer to the script via arguments is visible through ps -ax, /proc/<pid>/cmdline etc., BUT if someone has already gained access to your account from the outside (e.g. by hacking your browser) he will have no trouble looking not only ps -ax, but also periodically intercept /proc/<pid>/fd/0 (once intercepted, second skipped, to be less suspicious).

But this is nothing, because if an intruder got access to your account, it will not be difficult for him to just run keylogger (to listen to x11 server) and intercept keystrokes.

I am currently writing a script that runs through sudo (root) and accepts sensitive data. When sending them directly (as arguments) to a script, I can hard restrict the characters used in the arguments with sudo (user ALL = (root) NOPASSWD: /bin/program [0-9][0-9a-z][0-9a-z]...) so that an attacker cannot use special character combinations to bypass the restriction and thus gain root access.

When getting data through the pipe (stdin), I will also of course filter data:

#!/bin/sh
pass=$(dd if=/dev/stdin bs=1 count=10 2>/dev/null | tr -cd [:alnum:])

, but I consider simple rules of restriction of arguments through sudo safer (also in the script itself there will be additional checking).

So is there a fundamental difference between passing through stdin or arguments?

Answer 1

/proc/<pid>/fd/0 can only be read by the process owner and root. /proc/<pid>/cmdline can be read by all users.

Answer 2

In addition to the different permissions needed for a process' command line vs its pipes, consider:

Command lines often show up in audit logs, shell history, or similar; data passed to stdin does not.

Command lines are visible at any time from when the program starts to when it stops (which can be a very long time) even if nothing logs the command line or holds a reference to the process. Data in stdin (and other pipes) is ephemeral; if you want to intercept it, you need to do so at the right time (after writing and before reading).

Answer 3

The important part is not about an attacker compromising exactly your account.

Any account on a typical Linux system can run ps and see what others are running.

Even if your particular machine is personal and has a single (human) user, a typical modern Linux system has ~25 accounts created for internal use (just look in your /etc/passwd).

They exist for a reason - to limit the damage if some subsystem is compromised.

By exposing important information to these accounts, you effectively bypass this mechanism.

Answer 4

I think the title to your question and the body of your question are contradicting each other a bit and I think that may be leading to some of the confusion with the other correct answers.

Your title says "Is it really safe" but in the body of your request you're comparing passing data via stdin vs command line arguments. When you compare two things the result of the comparison only speaks to the comparison and never allows you to make an absolute claim outside of the comparison itself. For example: The number 10 is more than the number 5. So 10 is "bigger" than 5. But is 10 a "big" number when there are obviously much bigger numbers? I can't justify saying "10 is a big number" just because it's bigger than some other number.

So: "is it safe?" is one question, but your question is really implying: "Is it safer?" with an emphasis on the extra "r" on "safer".

Just like it doesn't make sense to say that 10 is a big number when there are always bigger numbers: Nothing in information security is ever 100% "safe". As you point out there are attack vectors that could allow an attacker to get at data passed via stdin. The point is that there are FAR fewer attack vectors that allow an attacker to get access to data passed via stdin. AND those vectors are more difficult to achieve.

As the other answers point out: Data passed via command line arguments are visible for a long time. They are very often logged into log files as well as history files like .bash_history. These log files and history files can get backed up to the cloud, copied to other folders, disks, etc. This data is also visible to other system accounts which could potentially be compromised. In other words: An attacker has a lot of available attack vectors to gain access to command line argument data. And because of how long this data remains around for viewing, the attacker also has a larger window of time for which he can utilize to execute these attacks and still access the command line data.

With stdin there are not only fewer vectors: But the attacker also has a limited time window to execute a successful attack here. He has to compromise your account specifically, or root. Both of which are more difficult than compromising one of the system accounts. Then assuming he pulls off a successful attack to compromise your account or root: Now he can only see data being passed to stdin in real time. He can't go back and look in bash_history or log files to see data from stdin.

Between the lower number of attack vectors and the timing issue: It's obvious that passing data via stdin is SAFER. And that's what matters: It's not possible for something to be 100% foolproof/safe. Everything in security is about choosing the safest possible option which minimizes the number of attack vectors or exposed "surface area" of points that can potentially be attacked and lead to a system becoming compromised.

So: TL;DR: No, stdin is not 100% safe as nothing is. But it's far SAFER than command line arguments which is why it's preferred over using command line arguments to pass sensitive data like passwords.

Answer 5

No. Nothing you do with a computer is 100% safe, and nothing in life is 100% safe. That's the wrong way to look at it. The question you should be asking is, which option offers more safety? When planning how to secure your system, you want to follow a defense in depth model: At every point while designing or configuring your system, you want to ask the question, which choice would improve my security?

Is passing sensitive data via stdin safer than passing it through the command line? Yes, for all the reasons CBHacking mentioned: stdin is ephemeral and requires greater privilege escalation to access.

Can someone who has gained access to the root account (or the account running the script) via privilege escalation intercept the data sent to stdin?

Absolutely. However, the command line arguments are accessible to any user account on your system for as long as the program is running, meaning that an attacker can choose which account they want to target, and has more opportunities to witness the sensitive data on the system.

If you give the attacker a choice, you should assume they will attack the most vulnerable account available, which will probably be one that you never thought to protect.

Using stdin to pass the data is not completely secure, and so that isn't the last step you should take to secure your system, if you're concerned about it. However, it is more safe than passing sensitive data on the command line.