Feature #10275

Automatically test that any administration password is not leaked in plaintext into the system

Added by anonym 2015-09-26 06:56:53 . Updated 2016-11-10 14:07:54 .

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Test suite
Target version:
Tails_2.7
Start date:
2015-09-26
Due date:
% Done:

0%

Feature Branch:
Type of work:
Code
Blueprint:

Starter:
Affected tool:
Deliverable for:

Description

We manually test that $TAILS_USER_PASSWORD is not set in some (shell) environments, but we could perhaps take it one step further by dumping the testing VMs memory and grep the dump for the password? I’m not sure how valid that is vs encodings, etc. so I guess we’d need an anti-test verifying that the approach works for other environment variables.

Subtasks

History

#1 Updated by anonym 2015-09-26 06:57:02

#2 Updated by kytv 2015-09-26 07:28:51

  • Tracker changed from Bug to Feature

#3 Updated by intrigeri 2015-10-03 15:30:39

I think that we should drop this test from the manual test suite, and not bother automating it: git grep TAILS_USER_PASSWORD in the Greeter repo shows that this test is equivalent to “is PostLogin.default run as root and not leaking its environment to the user session”. Since we’ve introduced the Greeter, we’ve ported it to Wheezy and then to Jessie, and this assumption has never been invalidated, so IMO it’s time to decide that we can trust these bits of code, and drop a test that’s never detected any bug. Also note that with systemd (and especially, its logind component) the chances that environment leaks from one user session to the other is greatly reduced.

> We manually test that $TAILS_USER_PASSWORD is not set in some (shell) environments, but we could perhaps take it one step further by dumping the testing VMs memory and grep the dump for the password?

I doubt we can expect all memory areas where that value has been put at some time to have been cleared, but I know basically nothing in this area and would be happy to be surprised and to learn a bit here :)

#4 Updated by anonym 2016-11-10 14:07:54

  • Status changed from Confirmed to Resolved
  • Target version set to Tails_2.7
  • QA Check set to Pass

I agree with intrigeri, and have removed this manual test.