Is the data transiting through a pipe confidential

pipeSecurity

I read the following question (Shell Script mktemp, what's the best method to create temporary named pipe?) but I'm wondering whether it is preferable to use a temporary named pipe to transfer sensitive data between programs as opposed to an unnamed/anonymous shell pipe?

Specifically I'm interested in whether this type of approach (from http://blog.kdecherf.com/2012/11/06/mount-a-luks-partition-with-a-password-protected-gpg-encrypted-key-using-systemd/) is safe:

# Open the encrypted block device
gpg --batch --decrypt $key_file 2>/dev/null | sudo $CRYPTSETUP -d - luksOpen $mount_device $key >& /dev/null || exit 3

In which cases could the Luks Keyfile be hijacked?

Best Answer

The command line you are suggesting is secure.

All other things being equal, "normal" anonymous pipes (created with the pipe(2) system call or the shell's familiar | syntax) are always going to be more secure than named pipes because there are fewer ways for something else outside the system to get ahold of either one of the ends of the pipe. For normal anonymous pipes, you can only read or write from the pipe if you already have in your possession a file descriptor for it, which means you must either be the process that created the pipe, or must have inherited it (directly or indirectly) from that process, or some process that had the file descriptor deliberately sent it to you through a socket. For named pipes, you can obtain a file descriptor to the pipe if you don't have one already by opening it by name.

On operating systems like Linux that have /proc there is always the possibility that another process can peek into /proc/pid/fd an access file descriptors belonging to a different process, but this is nothing unique to pipes (of whatever kind), and for that matter they can peek into another process' memory space too. The "peeker" must be either running under the same user as the subject or root, so it's not a security problem.

Related Question