feat: manually clear environ after unsetenv in one-shot-token#823
Closed
feat: manually clear environ after unsetenv in one-shot-token#823
Conversation
Add clear_from_environ() function to both C and Rust implementations to ensure environment variables are completely removed from the environ array after calling unsetenv(). This provides defense in depth by manually removing the entry from the environ pointer in addition to using the standard unsetenv() function. Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Claude
AI
changed the title
Add comprehensive test suite to verify that sensitive tokens are cleared from the environ array after being accessed via getenv(). Tests verify both C and Rust implementations. - test_environ_array.c: Primary test checking extern char **environ - test_proc_environ.c: Alternate test using /proc/self/environ - test_proc_environ_fork.c: Test using child processes - TESTS.md: Documentation explaining test approach and results All tests pass for both C and Rust libraries, confirming that the clear_from_environ() function correctly removes tokens from the environment array while maintaining cached access. Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Add test_environ_array, test_proc_environ, and test_proc_environ_fork to .gitignore and remove them from git tracking. These are compiled binaries that should be built locally. Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Document the fundamental Linux kernel limitation that /proc/self/environ is an immutable snapshot of the initial environment and cannot be updated by unsetenv() or any userspace API. Key points: - /proc/self/environ is a kernel snapshot from process start - Runtime setenv/unsetenv do NOT update /proc/self/environ - Only prctl(PR_SET_MM) with CAP_SYS_RESOURCE could update it (dangerous) - Solution: Do not pass sensitive tokens in initial environment - AWF agent containers inject tokens at runtime, so they never appear in /proc/self/environ This clarifies that our environ pointer clearing is correct and sufficient for protecting against getenv() inspection, and that /proc/self/environ protection only works if tokens are not in the initial environment. Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Plan: Address /proc/self/environ clearing
Summary
After extensive research and testing, I've documented a fundamental Linux kernel limitation regarding
/proc/self/environ:Key Findings:
/proc/self/environis an immutable kernel snapshot from process startsetenv()andunsetenv()do NOT update/proc/self/environCAP_SYS_RESOURCEand dangerousprctl(PR_SET_MM))What Our Implementation Does:
✅ Clears the
environglobal pointer - This affects allgetenv()calls✅ Manually clears from environ array - Defense in depth
✅ Calls
unsetenv()- Standard POSIX cleanup❌ Cannot clear
/proc/self/environ- Kernel limitationSecurity Implications:
Best Practice: Do NOT pass sensitive tokens in the initial environment. Instead:
setenv()after process starts/proc/self/environAWF Deployment: The agent container already follows this pattern - tokens are injected at runtime, so they never appear in
/proc/self/environ.Documentation Updates:
Updated README.md with: