[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-core-devel
Subject:    Re: KPasswordEdit patch (was Re: new widgets...)
From:       Pupeno <pupeno () pupeno ! com>
Date:       2002-09-27 20:36:09
[Download RAW message or body]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Friday 27 September 2002 04:48, Karl-Heinz Zimmer wrote:
> On Friday 27 September 2002 10:17, Neil Stevens wrote:
> > On Friday September 27, 2002 01:05, Simon Hausmann wrote:
> > > It is not more secure at all because the mlock()/munlock() calls
> > > will fail if the processes is not running with root privileges.
> > > Citing Waldo: Sorry, security is not optional :)
> >
> > Well, it's free software.  Anyone who wants it optional is going to make
> > it optional.  The only question is, are people going to be able to have
> > flexible security models within KDE, or will they have to fork KDE to do
> > so?
>
> OK, another question is:
>
>    Will people be able to run programs using KPasswordEdit if *not*
>    being able to run it as root?
>
> Not everybody has full control over the system she is working with so
> this change might result in some trouble in some programs...
>
> Just my 2 pence.  ;-)

If you don't have enough privileges or if something else goes wrong, mlock 
doesn't lock the memory, but the whole program it still runs, without 
problem, only in 'unsecure memory'. So, the patch won't stop anyone to use 
KPasswordEdit... it will just make it more secure when it cans.
I remember reading somewhere, that mlock wasn't forbiden to users but limited. 
While the root can mlock a lot of memory the users just some part, but I 
can't find that anymore.
The original patch also added a setPassword(const char *) method to set the 
password in the KPasswordEdit, is that a bad idea ?
Well, here I include another patch that only add setPassword() (const char * 
and const QString &) to KPasswordEdit if anyone is intrested.

- -- 
Pupeno: pupeno@pupeno.com
http://www.pupeno.com
- ---
Help the hungry children of Argentina, 
please go to (and make it your homepage):
http://www.porloschicos.com/servlet/PorLosChicos?comando=donar
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE9lME+Lr8z5XzmSDQRAtztAKDTXwI5NHY7xCSCuTuML6zIJT+Y1gCfSnLB
WyUg2gGjJA0/mkvw2hFuW/I=
=jIRd
-----END PGP SIGNATURE-----

["newsetpassword.patch" (text/x-diff)]

Index: kpassdlg.h
===================================================================
RCS file: /home/kde/kdelibs/kdeui/kpassdlg.h,v
retrieving revision 1.19
diff -c -r1.19 kpassdlg.h
*** kpassdlg.h	2002/03/05 23:13:27	1.19
--- kpassdlg.h	2002/09/27 20:07:20
***************
*** 67,72 ****
--- 67,82 ----
       * so you should make a copy.
       */
      const char *password() const { return m_Password; }
+     
+     /**
+      * Sets the password from a pointer to a char.
+      */
+     void setPassword(const char *);
+ 
+     /**
+      * Sets the password from a QString.
+      */
+     void setPassword(const QString &);
  
      /**
       * Erases the current password.
Index: kpassdlg.cpp
===================================================================
RCS file: /home/kde/kdelibs/kdeui/kpassdlg.cpp,v
retrieving revision 1.19
diff -c -r1.19 kpassdlg.cpp
*** kpassdlg.cpp	2002/04/03 15:26:26	1.19
--- kpassdlg.cpp	2002/09/27 20:07:21
***************
*** 36,41 ****
--- 36,42 ----
  #include <kaboutdialog.h>
  #include <kconfig.h>
  #include <kstandarddirs.h>
+ #include <kdebug.h>
  
  #include <sys/time.h>
  #include <sys/resource.h>
***************
*** 191,196 ****
--- 192,212 ----
      }
  }
  
+ void KPasswordEdit::setPassword(const char *pass)
+ {
+   if(strlen(pass) > 99){
+     kdDebug() << "Password being assigned is too long." << endl;
+   }
+   m_Length = (strlen(pass) > 99) ? 99 : strlen(pass);
+   strncpy(m_Password, pass, m_Length);
+   m_Password[m_Length] = '\000';
+   showPass();
+ }
+ 
+ void KPasswordEdit::setPassword(const QString &pass)
+ {
+   setPassword(pass.latin1());
+ }    
  
  /*
   * Password dialog.


[prev in list] [next in list] [prev in thread] [next in thread]