Re: 0.91RC1

Constantin --

Thanks for the feedback.

Aren't the perms on  '/proc/<PID>/environ set to 0400
and ownership set to the user ?

[konrad@kjhlt5 freetds]$ ps

   PID TTY          TIME CMD
  6649 pts/9    00:00:00 bash
24969 pts/9    00:00:00 ps

[konrad@kjhlt5 freetds]$ ls -la /proc/6649/environ

-r-------- 1 konrad users 0 Apr 10 08:00 /proc/6649/environ

I am missing something here but what am I missing ?

Thanks !

-- kjh


Constantin Vasilyev wrote, On 04/10/2011 07:56 AM:
> Hi Konrad,
>
> Unfortunatelly, it is not really safe to keep database password in environment variable.
> On Linux, for example, one could inspect other's process environment
> by looking into /proc/<PID>/environ
>
>
> Constantin
>
>
> On Sun, Apr 10, 2011 at 07:36:04AM -0400, Konrad J Hambrick wrote:
>>
>> I also found it useful (and more secure ps-wise) to
>> avoid setting the HostName / UserName / PassWord on
>> the commandline.
>>
>> freebcp.c already looks for a environment varb: FREEBCP
>> so I added code to src/apps/freebcp.c to use FREEBCPHOST,
>> FREEBCPUSER and FREEBCPPASS from the user's environment
>> instead of from the commandline.
>>
>