* call-scd.c (atfork_cb): New.

(start_scd): Make sure secmem gets cleared.
* query.c  (atfork_cb): New.
(start_pinentry): Make sure secmem gets cleared.

1 files changed, 13 insertions, 3 deletions

diff --git a/agent/call-scd.c b/agent/call-scd.c
index 14487f1e3..f205fb074 100644
--- a/agent/call-scd.c
+++ b/agent/call-scd.c
@@ -152,6 +152,16 @@ unlock_scd (int rc)
   return rc;
 }
 
+/* To make sure we leave no secrets in our image after forking of the
+   scdaemon, we use this callback. */
+static void
+atfork_cb (void *opaque, int where)
+{
+  if (!where)
+    gcry_control (GCRYCTL_TERM_SECMEM);
+}
+
+
 /* Fork off the SCdaemon if this has not already been done */
 static int
 start_scd (void)
@@ -206,9 +216,9 @@ start_scd (void)
     }
   no_close_list[i] = -1;
 
-  /* connect to the pinentry and perform initial handshaking */
-  rc = assuan_pipe_connect (&ctx, opt.scdaemon_program, (char**)argv,
-                            no_close_list);
+  /* Connect to the pinentry and perform initial handshaking */
+  rc = assuan_pipe_connect2 (&ctx, opt.scdaemon_program, (char**)argv,
+                             no_close_list, atfork_cb, NULL);
   if (rc)
     {
       log_error ("can't connect to the SCdaemon: %s\n",