{"action":"created","issue":{"url":"https://api.github.com/repos/conjurinc/summon/issues/42","repository_url":"https://api.github.com/repos/conjurinc/summon","labels_url":"https://api.github.com/repos/conjurinc/summon/issues/42/labels{/name}","comments_url":"https://api.github.com/repos/conjurinc/summon/issues/42/comments","events_url":"https://api.github.com/repos/conjurinc/summon/issues/42/events","html_url":"https://github.com/conjurinc/summon/issues/42","id":236539410,"number":42,"title":"Provide secrets via file descriptor","user":{"login":"Alan-R","id":1258659,"avatar_url":"https://avatars3.githubusercontent.com/u/1258659?v=3","gravatar_id":"","url":"https://api.github.com/users/Alan-R","html_url":"https://github.com/Alan-R","followers_url":"https://api.github.com/users/Alan-R/followers","following_url":"https://api.github.com/users/Alan-R/following{/other_user}","gists_url":"https://api.github.com/users/Alan-R/gists{/gist_id}","starred_url":"https://api.github.com/users/Alan-R/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Alan-R/subscriptions","organizations_url":"https://api.github.com/users/Alan-R/orgs","repos_url":"https://api.github.com/users/Alan-R/repos","events_url":"https://api.github.com/users/Alan-R/events{/privacy}","received_events_url":"https://api.github.com/users/Alan-R/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2017-06-16T16:59:37Z","updated_at":"2017-06-17T18:35:31Z","closed_at":null,"body":"Probably the most secure way for one application to give information is through a file which was created, opened, then removed. Here's a suggestion about how it might be implemented on UNIX-like systems:\r\n\r\n- Create a tmp file readable only by owner (mode 0600), and opened for read-write\r\n- unlink (remove) the temporary file \r\n- Write the name=value contents into it\r\n- seek to the beginning\r\n- pass the file descriptor number to the client program\r\n\r\nThe client program then reads the file, gets the secrets it wants, then closes the file. No other process on the system can at any time see the contents unless they open it before its been removed. Of course, someone with access to the block devices under the OS could read it. But then you're screwed anyway ;-).\r\n"},"comment":{"url":"https://api.github.com/repos/conjurinc/summon/issues/comments/309232320","html_url":"https://github.com/conjurinc/summon/issues/42#issuecomment-309232320","issue_url":"https://api.github.com/repos/conjurinc/summon/issues/42","id":309232320,"user":{"login":"kgilpin","id":86395,"avatar_url":"https://avatars3.githubusercontent.com/u/86395?v=3","gravatar_id":"","url":"https://api.github.com/users/kgilpin","html_url":"https://github.com/kgilpin","followers_url":"https://api.github.com/users/kgilpin/followers","following_url":"https://api.github.com/users/kgilpin/following{/other_user}","gists_url":"https://api.github.com/users/kgilpin/gists{/gist_id}","starred_url":"https://api.github.com/users/kgilpin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kgilpin/subscriptions","organizations_url":"https://api.github.com/users/kgilpin/orgs","repos_url":"https://api.github.com/users/kgilpin/repos","events_url":"https://api.github.com/users/kgilpin/events{/privacy}","received_events_url":"https://api.github.com/users/kgilpin/received_events","type":"User","site_admin":false},"created_at":"2017-06-17T18:35:31Z","updated_at":"2017-06-17T18:35:31Z","body":"I think that expanding the use of the keyring would be great. Not many people know about it and it provides a nice security profile. Keys are not even readable by root when they are in the keyring."}}
{"actor":{"display_login":"kgilpin"}}