diff options
Diffstat (limited to 'agent/query.c')
| -rw-r--r-- | agent/query.c | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/agent/query.c b/agent/query.c index 4a051965d..a3a773380 100644 --- a/agent/query.c +++ b/agent/query.c @@ -78,6 +78,17 @@ unlock_pinentry (int rc) return rc; } + +/* To make sure we leave no secrets in our image after forking of the + pinentry, we use this callback. */ +static void +atfork_cb (void *opaque, int where) +{ + if (!where) + gcry_control (GCRYCTL_TERM_SECMEM); +} + + /* Fork off the pin entry if this has not already been done. Note, that this function must always be used to aquire the lock for the pinentry - we will serialize _all_ pinentry calls. @@ -139,9 +150,9 @@ start_pinentry (CTRL ctrl) } no_close_list[i] = -1; - /* connect to the pinentry and perform initial handshaking */ - rc = assuan_pipe_connect (&ctx, opt.pinentry_program, (char**)argv, - no_close_list); + /* Connect to the pinentry and perform initial handshaking */ + rc = assuan_pipe_connect2 (&ctx, opt.pinentry_program, (char**)argv, + no_close_list, atfork_cb, NULL); if (rc) { log_error ("can't connect to the PIN entry module: %s\n", |