wifi.rs shells a raw `nmcli … password …` fallback — same argv/history leak as CRUMB-5, but inside breadbar itself #16

New issue

Closed

opened 2026-09-05 02:42:03 +08:00 by Breadway · 0 comments

Breadway commented

2026-09-05 02:42:03 +08:00

Owner

What's broken

Found as a side-effect of fixing CRUMB-5 (breadcrumbs' add <ssid> [password] leaking the Wi-Fi password onto argv/shell history via a positional CLI arg).

src/bar/wifi.rs:182-193 (spawn_add_and_join), breadbar's "join network" GUI dialog handler, does two things with the password:

Calls breadcrumbs add <ssid> <password> positionally — this is the caller CRUMB-5's fix (git.breadway.dev/Breadway/breadcrumbs/pulls/7) deliberately stayed backward-compatible with, since removing the positional arg outright would break this exact call site. That PR adds --password-stdin as the preferred path and a deprecation warning on the positional form.
Separately shells a raw nmcli … password … fallback command — this is a second, independent instance of the same leak class, entirely inside breadbar, unrelated to breadcrumbs' CLI surface.

Both put the plaintext Wi-Fi password into this process's argv (visible to any other local user via ps//proc/<pid>/cmdline) and, if either path is ever invoked from a shell rather than spawned directly, into shell history.

Fix

Migrate the breadcrumbs add call to --password-stdin (now available per CRUMB-5's fix) instead of the positional arg.
Replace the raw nmcli … password … invocation with nmcli's stdin/--ask secret-input path, or route through breadcrumbs (D-Bus-based, already the ecosystem's designated secret-safe path per breadcrumbs' own rework history) instead of shelling nmcli directly.

Repro

Open breadbar's Wi-Fi join dialog, connect to a secured network.
ps -ef | grep -E 'breadcrumbs add|nmcli' (or watch /proc/<pid>/cmdline) during the connect — the password is visible in plaintext in the process arguments.

## What's broken Found as a side-effect of fixing CRUMB-5 (breadcrumbs' `add <ssid> [password]` leaking the Wi-Fi password onto argv/shell history via a positional CLI arg). `src/bar/wifi.rs:182-193` (`spawn_add_and_join`), breadbar's "join network" GUI dialog handler, does two things with the password: 1. Calls `breadcrumbs add <ssid> <password>` positionally — this is the caller CRUMB-5's fix (git.breadway.dev/Breadway/breadcrumbs/pulls/7) deliberately stayed backward-compatible with, since removing the positional arg outright would break this exact call site. That PR adds `--password-stdin` as the preferred path and a deprecation warning on the positional form. 2. Separately shells a raw `nmcli … password …` fallback command — this is a second, independent instance of the same leak class, entirely inside breadbar, unrelated to breadcrumbs' CLI surface. Both put the plaintext Wi-Fi password into this process's argv (visible to any other local user via `ps`/`/proc/<pid>/cmdline`) and, if either path is ever invoked from a shell rather than spawned directly, into shell history. ## Fix - Migrate the `breadcrumbs add` call to `--password-stdin` (now available per CRUMB-5's fix) instead of the positional arg. - Replace the raw `nmcli … password …` invocation with `nmcli`'s stdin/`--ask` secret-input path, or route through `breadcrumbs` (D-Bus-based, already the ecosystem's designated secret-safe path per breadcrumbs' own rework history) instead of shelling `nmcli` directly. ## Repro 1. Open breadbar's Wi-Fi join dialog, connect to a secured network. 2. `ps -ef | grep -E 'breadcrumbs add|nmcli'` (or watch `/proc/<pid>/cmdline`) during the connect — the password is visible in plaintext in the process arguments.

Breadway

2026-09-05 02:42:04 +08:00