Patch to modify argv so as to not show the password
in process list (ps auxwww | grep davfs), when
specifying command-line argument -opassword= . In
general it would be better to not enter the password in
the command-line arguments at all, as addressed in
patch 695462. But for users who choose to do so, at
least it is better not to display the password with ps.
Also, this is a simple, short, local patch. It is
still possible to determine the length of the password
by ps auxwww | grep davfs | od -c . If davfs is
invoked through sudo, then the command-line arguments
can be found SUDO_COMMAND in /proc/pid/environ, but at
least that's root.root 0400.
Log in to post a comment.