Security – How Does Curl Protect a Password from Appearing in ps Output?

When the kernel executes a process, it copies the command line arguments to read-write memory belonging to the process (on the stack, at least on Linux). The process can write to that memory like any other memory. When ps displays the argument, it reads back whatever is stored at that particular address in the process's memory. Most programs keep the original arguments, but it's possible to change them. The POSIX description of ps states that

It is unspecified whether the string represented is a version of the argument list as it was passed to the command when it started, or is a version of the arguments as they may have been modified by the application. Applications cannot depend on being able to modify their argument list and having that modification be reflected in the output of ps.

The reason this is mentioned is that most unix variants do reflect the change, but POSIX implementations on other types of operating systems may not.

This feature is of limited use because the process can't make arbitrary changes. At the very least, the total length of the arguments cannot be increased, because the program can't change the location where ps will fetch the arguments and can't extend the area beyond its original size. The length can effectively be decreased by putting null bytes at the end, because arguments are C-style null-terminated strings (this is indistinguishable from having a bunch of empty arguments at the end).

If you really want to dig, you can look at the source of an open-source implementation. On Linux, the source of ps isn't interesting, all you'll see there is that it reads the command line arguments from the proc filesystem, in /proc/PID/cmdline. The code that generates the content of this file is in the kernel, in proc_pid_cmdline_read in fs/proc/base.c. The part of the process's memory (accessed with access_remote_vm) goes from the address mm->arg_start to mm->arg_end; these addresses are recorded in the kernel when the process starts and can't be changed afterwards.

Some daemons use this ability to reflect their status, e.g. they change their argv[1] to a string like starting or available or exiting. Many unix variants have a setproctitle function to do this. Some programs use this ability to hide confidential data. Note that this is of limited use since the command line arguments are visible while the process starts.

Most high-level languages copy the arguments to string objects and don't give a way to modify the original storage. Here's a C program that demonstrates this ability by changing argv elements directly.

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int main(int argc, char *argv[])
{
    int i;
    system("ps -p $PPID -o args=");
    for (i = 0; i < argc; i++)
    {
        memset(argv[i], '0' + (i % 10), strlen(argv[i]));
    }
    system("ps -p $PPID -o args=");
    return 0;
}

Sample output:

./a.out hello world
0000000 11111 22222

You can see argv modification in the curl source code. Curl defines a function cleanarg in src/tool_paramhlp.c which is used to change an argument to all spaces using memset. In src/tool_getparam.c this function is used a few times, e.g. by redacting the user password. Since the function is called from the parameter parsing, it happens early in a curl invocation, but dumping the command line before this happens will still show any passwords.

Since the arguments are stored in the process's own memory, they cannot be changed from the outside except by using a debugger.