Bug 2316073

Summary:	7z wrapper jeopardizing the effort to hide password from commandline parameters
Product:	[Fedora] Fedora	Reporter:	Michal Ambroz <rebus>
Component:	p7zip	Assignee:	Sergio Basto <sergio>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	sergio
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	p7zip-16.02-31.fc40 p7zip-16.02-31.fc41 p7zip-16.02-31.el8 p7zip-16.02-31.el9 p7zip-16.02-31.fc39	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-10-06 02:12:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Michal Ambroz 2024-10-02 09:15:17 UTC

Hello,
the 7z (/usr/libexec/p7zip/7z) is trying to clear the password from the process command attributes as soon as it is not needed anymore. 
Unfortunately in Fedora we have a wrapper /usr/bin/7z which is doing nothing else than executing /usr/libexec/p7zip/7z , which will still reveal the password.

Running for example:
7z a test.7z test.dd -mx=9 -ppassword123

Will result in this process listing:
rebus  2713410  0.0  0.0 228500  3612 pts/24   S+   10:45   0:00 /usr/bin/sh /usr/bin/7z a test.7z test.dd -mx=9 -ppassword123
rebus  2713411  121  0.4 1079920 154904 pts/24 R+   10:45   0:08 /usr/libexec/p7zip/7z a test.7z test.dd -mx=9 -p***********


Possible solutions:
1) using the wrapper with a "exec statement to replace the current process"
2) use just a link file
3) compile the 7z in such a way that it can be placed directly to /usr/bin/7z and search the 7z.so in some expectable library location

As using the link file would break 7z, and changing the 7z location needs much more work on the code, I guess using the exec is the right way to go.

The usr/bin/7z should read like this:
#!/usr/bin/sh
exec "/usr/libexec/p7zip/7z" "$@"











Reproducible: Always

Steps to Reproduce:
1. run in one terminal this loop 
while true ; do ps aux|grep -e '[7]z' ; done | less

2. prepare some reasonably big file
dd if=/dev/zero of=test.dd bs=1M count=100

3. try to zip the file with password 
7z a test.7z test.dd -mx=9 -ppassword123


Actual Results:  
rebus  2713410  0.0  0.0 228500  3612 pts/24   S+   10:45   0:00 /usr/bin/sh /usr/bin/7z a test.7z test.dd -mx=9 -ppassword123
rebus  2713411  121  0.4 1079920 154904 pts/24 R+   10:45   0:08 /usr/libexec/p7zip/7z a test.7z test.dd -mx=9 -p***********

Expected Results:  
rebus  2713411  121  0.4 1079920 154904 pts/24 R+   10:45   0:08 /usr/libexec/p7zip/7z a test.7z test.dd -mx=9 -p***********

-------------------- cut here -------------
For completenes
Using link file results in this error:
sudo rm /usr/bin/7z
sudo ln -s /usr/libexec/p7zip/7z /usr/bin/7z
$ 7z a test.7z test.dd -mx=9 -ppassword123

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,8 CPUs Intel(R) Core(TM) i5-8365U CPU @ 1.60GHz (806EC),ASM,AES-NI)

Can't load './7z.dll' (./7z.so: cannot open shared object file: No such file or directory)


ERROR:
7-Zip cannot find the code that works with archives.

Comment 1 Michal Ambroz 2024-10-02 22:05:59 UTC

I have created push request for that:
https://src.fedoraproject.org/rpms/p7zip/pull-request/6

Comment 2 Michal Ambroz 2024-10-03 06:37:56 UTC

Reported the issue upstream, but as upstream p7zip project is abandoned I wont expect much change there.
https://sourceforge.net/p/p7zip/patches/38/

Comment 3 Sergio Basto 2024-10-03 11:12:45 UTC

thank you, 7zip was unified  and the "p" for ported has dropped
so the project now is in https://sourceforge.net/projects/sevenzip/files/

I'm planning build this [1] soon

[1] 
https://sourceforge.net/projects/sevenzip/files/7-Zip/24.08/

Comment 4 Fedora Update System 2024-10-04 02:02:37 UTC

FEDORA-2024-ec78ab2c45 (p7zip-16.02-31.fc39) has been submitted as an update to Fedora 39.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-ec78ab2c45

Comment 5 Fedora Update System 2024-10-04 02:03:21 UTC

FEDORA-2024-5c99e1d579 (p7zip-16.02-31.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-5c99e1d579

Comment 6 Fedora Update System 2024-10-04 02:03:44 UTC

FEDORA-2024-6ecf5236ae (p7zip-16.02-31.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-6ecf5236ae

Comment 7 Fedora Update System 2024-10-04 02:04:02 UTC

FEDORA-EPEL-2024-8de34d4fda (p7zip-16.02-31.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-8de34d4fda

Comment 8 Fedora Update System 2024-10-04 02:04:27 UTC

FEDORA-EPEL-2024-851c74616f (p7zip-16.02-31.el8) has been submitted as an update to Fedora EPEL 8.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-851c74616f

Comment 9 Michal Ambroz 2024-10-04 13:50:12 UTC

tested and works for F40 (and probably others as well)

Comment 10 Fedora Update System 2024-10-05 01:33:20 UTC

FEDORA-2024-ec78ab2c45 has been pushed to the Fedora 39 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-ec78ab2c45`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-ec78ab2c45

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 11 Fedora Update System 2024-10-05 01:41:37 UTC

FEDORA-EPEL-2024-8de34d4fda has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-8de34d4fda

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 12 Fedora Update System 2024-10-05 01:58:23 UTC

FEDORA-2024-5c99e1d579 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-5c99e1d579`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-5c99e1d579

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 13 Fedora Update System 2024-10-05 02:01:16 UTC

FEDORA-EPEL-2024-851c74616f has been pushed to the Fedora EPEL 8 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2024-851c74616f

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 14 Fedora Update System 2024-10-05 02:57:53 UTC

FEDORA-2024-6ecf5236ae has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-6ecf5236ae`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-6ecf5236ae

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 15 Fedora Update System 2024-10-06 02:12:04 UTC

FEDORA-2024-5c99e1d579 (p7zip-16.02-31.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 16 Fedora Update System 2024-10-09 00:16:44 UTC

FEDORA-2024-6ecf5236ae (p7zip-16.02-31.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 17 Fedora Update System 2024-10-13 00:39:34 UTC

FEDORA-EPEL-2024-851c74616f (p7zip-16.02-31.el8) has been pushed to the Fedora EPEL 8 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 18 Fedora Update System 2024-10-13 00:42:07 UTC

FEDORA-EPEL-2024-8de34d4fda (p7zip-16.02-31.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 19 Fedora Update System 2024-10-13 01:32:12 UTC

FEDORA-2024-ec78ab2c45 (p7zip-16.02-31.fc39) has been pushed to the Fedora 39 stable repository.
If problem still persists, please make note of it in this bug report.