From 9fc92a15bd0a30437a39d0eb28b6f40edc22e6e8 Mon Sep 17 00:00:00 2001 From: Werner Koch Date: Wed, 16 Nov 2016 10:12:19 +0100 Subject: core: Do not leak the override session key to ps(1). * src/engine-gpg.c (struct engine_gpg): New field override_session_key. (gpg_release): Free that field. (gpg_decrypt): With gnupg 2.1.16 use --override-session-key-fd. * tests/run-decrypt.c (main): Fix setting over the override key. -- Note that this works only with gnupg 2.1.16 and later. Signed-off-by: Werner Koch --- doc/gpgme.texi | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'doc') diff --git a/doc/gpgme.texi b/doc/gpgme.texi index 4f899a9e..32e08618 100644 --- a/doc/gpgme.texi +++ b/doc/gpgme.texi @@ -2910,7 +2910,9 @@ not exported. The string given in @var{value} is passed to the GnuPG engine to override the session key for decryption. The format of that session key is specific to GnuPG and can be retrieved during a decrypt operation when -the context flag "export-session-key" is enabled. +the context flag "export-session-key" is enabled. Please be aware that +using this feature with GnuPG < 2.1.16 will leak the session key on +many platforms via ps(1). @end table -- cgit