System Calls From C Code

Question

after many searches and tries, finally I found a way to protect my python code on my raspberry pi (for sure there is no 100% security), but let's say I made it a little bit harder.

This method still needs a small modification to complete. I can post what I need only, but I preffered to post the whole procedure in case someone else get the benifit of it.

I have the following python script: test.py I have encrypted this script using the following command:

gpg -c test.py

Then it asked me to enter a password twice: and I set the password suppose it is 123456

I removed test.py, and I left the new encrypted file test.py.gpg

till now everything is working true just as I want, and now I have an encrypted python script.

now to execute this file I should decrypt it, execute it and then remove it. so if I Type:

gpg test.py.gpg

it prompts me to enter the password then I entered the password then it recreates the original file named test.py and then I can execute it using the command: sudo python test.py and so keeping the program running and remove it using sudo rm test.py

now to call this script, I created a small C program, as this is the only way to call it with keeping the password hidden from intruders (except super genius intruders :) ).

in this program I just wrote these simple lines:

system("sudo gpg gpgTest.py.gpg");
system("123456"); //The password
system("sudo python gpgTest.py");
system("sudo rm gpgTest.py");

when I try to execute this c program, it prompt me to enter the password, which means the second line is not doing the job. so how can I modify the above code, so that I call the decryption command and wait until the system ask for password then pass password to it, and complete the execution of the rest code?

In another way, all I need is to execute the encrypted python code from the c program, without the need to enter the password, as the password must be passed inside the C code.

I just noticed another issue, is that calling system to execute the program would not allow the rm command to do it jobs until execution ended. What I really need, is to open another instance of system calls to execute the rm command directly after executing the the python script.

Answer 1

If you need to provide input for a command, you should do it via input substitution or pipes, like this:

system("echo 123456 | gpg --passphrase-fd 0 gpgTest.py.gpg");
system("gpg --passphrase-fd 0 gpgTest.py.gpg < (echo 123456)");

Check out this question for the explanation about --passphrase-fd 0.

If you need to continue execution without waiting for the command to complete, add an & character to it, like this:

system("sudo python gpgTest.py&");

Though in that case you'll have to make sure python has a chance to read the file before you remove it.

Be aware that rm doesn't really erase files, you should use srm, wipe or shred instead. Also, hiding a password inside a C file is a polichinelle's secret: simply running strings a.out will reveal your password in cleartext.