Re: [libvirt PATCH 0/5] Formalize the deprecation of arguments in virsh
On Tue, Mar 23, 2021 at 15:19:44 +0100, Michal Privoznik wrote:
On 3/23/21 3:04 PM, Peter Krempa wrote:
> On Tue, Mar 23, 2021 at 14:50:09 +0100, Michal Privoznik wrote:
> > On 3/23/21 2:42 PM, Daniel P. Berrangé wrote:
> > > On Tue, Mar 23, 2021 at 02:36:19PM +0100, Michal Privoznik wrote:
[...]
> The only thing that IMO should be removed but I didn't for
compatibility
> is the 'secret-set-value's 'base64' parameter as that is insecure.
There
> isn't a compatible replacement though.
>
That's debatable. Its not much worse than reading from a file. I mean, who
has access to my $HISTFILE? Only me and root and in both cases the secret
It's not about HISTFILE, but about the process listing. On a default
linux box, all users can list all other user's processes. If your
password is an argument for a command, it will be readable for other
users without the access to your directory.
Arguably, the lifetime of virsh is very short, so it's extremely
unlikely for anyone to notice, but it's insecure regardless.
can be changed or read from the file (if the file is not deleted
right away,
and even then it could be recovered). Many tools accept passwords in clear
text on cmd line (e.g. curl, wget). If anything, we could document why
You should avoid use of those arguments if you are on a multi-user box.
--base64 is dangerous (if we haven't done so yet).
It is documented as such and also prints a warning as pointed out in the
other reply.