1

after many searches and tries, finally I found a way to protect my python code on my raspberry pi (for sure there is no 100% security), but let's say I made it a little bit harder.

This method still needs a small modification to complete. I can post what I need only, but I preffered to post the whole procedure in case someone else get the benifit of it.

I have the following python script: test.py I have encrypted this script using the following command:

gpg -c test.py

Then it asked me to enter a password twice: and I set the password suppose it is 123456

I removed test.py, and I left the new encrypted file test.py.gpg

till now everything is working true just as I want, and now I have an encrypted python script.

now to execute this file I should decrypt it, execute it and then remove it. so if I Type:

gpg test.py.gpg

it prompts me to enter the password then I entered the password then it recreates the original file named test.py and then I can execute it using the command: sudo python test.py and so keeping the program running and remove it using sudo rm test.py

now to call this script, I created a small C program, as this is the only way to call it with keeping the password hidden from intruders (except super genius intruders :) ).

in this program I just wrote these simple lines:

system("sudo gpg gpgTest.py.gpg");
system("123456"); //The password
system("sudo python gpgTest.py");
system("sudo rm gpgTest.py");

when I try to execute this c program, it prompt me to enter the password, which means the second line is not doing the job. so how can I modify the above code, so that I call the decryption command and wait until the system ask for password then pass password to it, and complete the execution of the rest code?

In another way, all I need is to execute the encrypted python code from the c program, without the need to enter the password, as the password must be passed inside the C code.

I just noticed another issue, is that calling system to execute the program would not allow the rm command to do it jobs until execution ended. What I really need, is to open another instance of system calls to execute the rm command directly after executing the the python script.

  • You might be interested in knowing that rm doesn't actually erase files from the disk, it simply marks them as "removed". Removed files can easily be recovered with extundelete and similar tools. – Dmitry Grigoryev Oct 27 '16 at 10:07
  • and I'll be interested more if you know any command other than rm to completely erase files – Dani Oct 27 '16 at 10:08
  • I think this will do the job: 4 Tools to Securely Delete Files from Linux – Dani Oct 27 '16 at 10:18
  • Yes, srm command looks good. But don't expect your setup to provide good protection anyway. Check my answer. – Dmitry Grigoryev Oct 27 '16 at 10:20
  • If internet connection is available on the targeted systems, I suggest you to focus on license server setup. You wrapper written in C can communicate with this server for secrets. – vaha Oct 27 '16 at 10:29
3

If you need to provide input for a command, you should do it via input substitution or pipes, like this:

system("echo 123456 | gpg --passphrase-fd 0 gpgTest.py.gpg");
system("gpg --passphrase-fd 0 gpgTest.py.gpg < (echo 123456)");

Check out this question for the explanation about --passphrase-fd 0.

If you need to continue execution without waiting for the command to complete, add an & character to it, like this:

system("sudo python gpgTest.py&");

Though in that case you'll have to make sure python has a chance to read the file before you remove it.

Be aware that rm doesn't really erase files, you should use srm, wipe or shred instead. Also, hiding a password inside a C file is a polichinelle's secret: simply running strings a.out will reveal your password in cleartext.

  • Seems perfect! but after testing it, it still prompt me to enter the password! – Dani Oct 27 '16 at 10:36
  • Though in that case you'll have to make sure python has a chance to read the file before you remove it (I think using sleep(1); will do the job) – Dani Oct 27 '16 at 10:37
  • @Dani this is probably because of sudo. Dump it from everywhere and run your C program with sudo instead. – Dmitry Grigoryev Oct 27 '16 at 10:40
  • I think this is the near best solution for scripting languages. – vaha Oct 27 '16 at 10:47
  • 1
    @Dani It also would be quite easy to alias cat as python in the PATH and directly have a look at your code whenever your C program tries to run it. – TonioElGringo Oct 27 '16 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.