Closed Bug 1120955 Opened 11 years ago Closed 10 years ago

[mig agent] pipe module parameters

Categories

(Enterprise Information Security Graveyard :: MIG, task)

Product:
Enterprise Information Security Graveyard
Component:
MIG
Platform:
x86_64
Linux
Type:
task
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: jvehent, Assigned: jvehent)

References

Details

Upon processing of a command, mig-agent invokes a module by executing it and passing parameters on the command line. This approach, while straighforward to implement, is showing limitations: - sensitive parameters, like searches for secrets in files, are visible in the process table and captured and logged by auditd - the maximum parameter size is limited by the max length of command line arguments, which is problematic for operations that have a large number of parameters A better approach would be to pipe module parameters and module results between the agent and the module. This could be done using any flavor of socket.
Depends on: 1130749
Fixed in https://github.com/mozilla/mig/pull/51
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
Component: Operations Security (OpSec): MIG → MIG
Product: mozilla.org → Enterprise Information Security
Product: Enterprise Information Security → Enterprise Information Security Graveyard
You need to log in before you can comment on or make changes to this bug.