2

I am working on a web-service based crypto project in JAVA. The basic idea is for the client to send a SOAP request to a servlet to encrypt data. For data transmission I am using MIME/data-handlers and I noticed that MIME stores the data being transmitted in a temporary file if the size is larger then a given amount. Even though this file will be garbage collected I would prefer it to not even be on my system. Thus, I have been writing this temporary file to /dev/null. As this is just a project it is not the end of the world if someone could still read the temp file but it made me think about a production environment where this could be a huge issue.

Is writing to /dev/null safe and secure? Is it the same as not writing the file at all? Could someone still access the plaintext temp file that is being written ie, as it is being written?

4

Is it possible to replace /dev/null with something else. Try it (as root):

mv /dev/null /dev/null-real
mkfifo /dev/null # Create a FIFO pipe to read/write data
while read line; do echo "Incoming: $line"; done < /dev/null &
echo secretdata > /dev/null

You will see a message saying Incoming: secretdata in your terminal. This is because the "while read" loop is "backgrounded" (the & sign does that). This means it will run in the background while the next line is executed. Anything written to our FIFO pipe, located at /dev/null, will be picked up and displayed.

If you tried this on your computer, you can restore the original situation simply by doing:

rm /dev/null
mv /dev/null-real /dev/null

Having a listener on /dev/null is extremely uncommon, though. I think only root can do this. If you really really care, you could also check whether /dev/null is actually the original /dev/null device (you can see in stat /dev/null it's a certain kind of device with a certain inode). I don't think it's worth doing that though, because:

TL;DR: If you can't trust your server administrator to leave the /dev/null device alone, your application shouldn't be running there anyway.

2
  • It doesn't need to be a fifo. It could be a simple textfile, too. That much about people linking their ~/.bash_history to /dev/null :-)
    – ott--
    Jun 30 '15 at 18:30
  • @ott-- sure, though it's sort of inconvenient if every user overwrites the file (stdout > /dev/null) instead of appending. That's why I made it a fifo... but of course you're right :)
    – Luc
    Jul 1 '15 at 23:20
3

Writing to /dev/null is as safe as the OS allows. You're using it for the exact purpose it was built for, redirecting output to nowhere. /dev/null is part of the UNIX philosophy where everything is a file, including devices. It's a special file recognized by the kernel, and the output is never written anywhere.

Anyone with root level access could still gain access to the data through various different means, including redirecting /dev/null somewhere else. This is unavoidable as root level access can do anything, including reading arbitrary memory locations, and replacing parts of the OS or your application.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.