I'm currently fascinated by strace so, being new to it, I decided to play around a little. As suggested by the question title, I tried both strace su and strace ssh. Both commands displayed the password I typed in the strace output. su kept complaining of an incorrect password while ssh managed to log in normally.My questions:Is this a security flaw or am I missing something? Is su reporting an incorrect password as a security measure because it detected it was being run through strace? If so how can it tell that it's being invoked through strace? Does it check /proc/self/cmdline maybe?How much damage can be caused by something likealias su=strace -o /tmp/output.log su
Stracing su and ssh shows the password. Is this a security flaw or am I missing something?
security;password;strace
It's not a security flaw; you're able to strace the process because it's your process. You can't just attach strace to any running process. For example:$ sudo sleep 30 &[1] 3660$ strace -p 3660attach: ptrace(PTRACE_ATTACH, ...): Operation not permittedsu is reporting an incorrect password because it doesn't have sufficient permission to read /etc/shadow anymore. /etc/shadow is where your password hash is stored, and it's set so only root can read it for security reasons. su has the setuid bit set so it will be effectively run as root no matter who runs it, but when you run it through strace that doesn't work, so it ends up running under your accountI'm not sure what you mean by how much damage could be caused. As you saw, su doesn't work from within strace, so you're going to render it nonfunctional. If you mean could somebody use this to steal my password, they would need the ability to set aliases in your shell, which they shouldn't have permission to do unless you've made your login files world-writable or something similar. If they did have permission to set aliases, they could just alias su to a patched version that records your password directly; there's nothing special about strace