Sensitive info passed on command line may unexpectedly leak

[rayanayar]

Summary of the "bug":
ffmpeg records video stream from IP-cam.
IP-cam has authentication.

ffmpeg \
  -t 3600 \
  -i rtsp://admin:PASSWORD@192.168.0.100/stream1 \
  -vcodec copy -acodec copy "$(date +%Y-%m-%d+%H-%M-%S).mkv"

ffmpeg starts from cron script by unprivileged user.
At the same host can be logged interactive users.

The problem is: interactive users can see ffmpeg command line "by ps", thus users can see IP-cam password.

$ ps -f -C ffmpeg
UID        PID  PPID  C STIME TTY          TIME CMD
backup    1506  1423 88 07:47 pts/11   00:00:08 ffmpeg -t 3600 -i rtsp://admin:PASSWORD@192.168.0.100/stream1 ...

This applies not only to RTSP, but also to all protocols with authorization (ftp, http...).

Possible solutions...
ffmpeg get input (-i) from file:

echo 'rtsp://admin:PASSWORD@192.168.0.100/stream1' > input.txt
ffmpeg \
  -t 3600 \
  -f inputasfile -i input.txt \
  -vcodec copy -acodec copy "$(date +%Y-%m-%d+%H-%M-%S).mkv"

echo 'rtsp://admin:PASSWORD@192.168.0.100/stream1' > input.txt
ffmpeg \
  -t 3600 \
  -i @input.txt \
  -vcodec copy -acodec copy "$(date +%Y-%m-%d+%H-%M-%S).mkv"

ffmpeg get input from environment var:

INPUT='rtsp://admin:PASSWORD@192.168.0.100/stream1'
ffmpeg \
  -t 3600 \
  -i @INPUT \
  -vcodec copy -acodec copy "$(date +%Y-%m-%d+%H-%M-%S).mkv"

[MasterQuestionable]

͏    The very problem applies for all CLI apps:
͏    `ps` alike may return the command line in somehow unexpected manner.
͏    .
͏    OS issue mostly.
͏    Mostly not something FFmpeg may address.

[rayanayar]

Yes, ffmpeg can't change OS behavior.
But ffmpeg can solve this.
Like other programs, which can get sensitive info from files or envvars.

For example, Curl and Wget use ".netrc" (.wgetrc) file, where stored all sensitive data.

When mounting samba share...
user/pass can be passed from command line (which is vulnerable to "ps"):

mount -t cifs -o user=user,pass=arg ...

or from file:

mount -t cifs -o credentials=./secret.cred ...

or from envvar:

USER="alice" PASSWD="12345" mount -t cifs ...

Also ffmpeg could get "input" from envvar, for example by filter:

INPUT='rtsp://admin:PASSWORD@192.168.0.100/stream1'
ffmpeg \
  -t 3600 \
  -f envvar -i INPUT \
  -vcodec copy -acodec copy "$(date +%Y-%m-%d+%H-%M-%S).mkv"

Filter "envvar" tells get input from specified variable name.
This will be enough to protect from "ps".
I guess this filter will be simple to implement.

[MasterQuestionable]

͏    Interesting.
͏    But see also: ​https://trac.ffmpeg.org/ticket/11220#comment:4
͏    In many cases FFmpeg assumed full control of the system.
͏    .
͏    And don't expect too much on FFmpeg's networking functionality:
͏    As it still struggles on its core multi-media handling...

͏    Anyway try the "concat" demuxer workaround:
͏    https://ffmpeg.org/ffmpeg-formats.html#concat
͏    ​https://trac.ffmpeg.org/wiki/Concatenate

[rayanayar]

Yes, I "googled" concat demuxer. I've tried it. Doesn't work.

I didn't understand the argument about network.
ffmpeg can be used for recording rtsp? - yes
Passwords passed to ffmpeg is vulnerable if passed by command line.
Can ffmpeg get passwords from envvar instead of command line?

[MasterQuestionable]

͏    Vulnerable only if the system is under certain vulnerable multi-user mode...
͏    To my knowledge, no? (not entirely sure)

͏    For "rtsp://" alike to possibly work in "concat": "-safe 0" is needed.

[rayanayar]

May be I did something wrong...

But I tried exactly "-safe 0". And it says something like "network source disallowed". I decided that "concat" is for files only, not for network streams.

May be I must do something else in addition to "-safe 0"?

[rayanayar]

Tried again, here is the output:

$ cat concat.txt
file 'rtsp://admin:PASSWORD@192.168.0.100/stream1'
$ ./ffmpeg -t 10 -f concat -safe 0 -i concat.txt -vcodec copy -acodec copy "$(date +%Y-%m-%d+%H-%M-%S).mkv"
[tcp @ 0x8143280] Protocol 'tcp' not on whitelist 'file,crypto,data'!
[concat @ 0x8136f00] Impossible to open 'rtsp://admin:PASSWORD@192.168.0.100/stream1'
[in#0 @ 0x8136b80] Error opening input: Invalid argument
Error opening input file concat.txt.
Error opening input files: Invalid argument

[MasterQuestionable]

͏    "-protocol_whitelist ALL"?
͏    https://ffmpeg.org/ffmpeg-protocols.html#Protocol-Options

͏    Also "concatf":
͏    https://ffmpeg.org/ffmpeg-protocols.html#concatf

[rayanayar]

Yes, it works!:

-protocol_whitelist file,tcp,rtp,udp

Thanks. I found many manuals with concat, but nowhere were "-protocol_whitelist" option, because all of them were about files, but not network streams.

I will rewrite my recording-script for use concat.
Bugreport can be closed.

[MasterQuestionable]

͏    Would "concatf" work better?
͏    <&>And probably without needing to pass "-protocol_whitelist"?</&> [ No, per the source. ]

͏    Many things are under-documented obscure...

͏    ----

͏    Major security risk of FFmpeg processing untrusted sources, is much similar to browsers handling untrusted JavaScript:
͏͏    Exploits in the media file wouldn't be mitigated by "-protocol_whitelist".
͏    (network connection already allowed; and probably wouldn't apply for unconventional code execution)

[rayanayar]

I quickgoogled (about 10) minutes and don't understand how "concatf:" works.

$ ./ffmpeg -protocols | grep concat
  concat
  concatf
$ ./ffmpeg -t 10 -i concatf:concatf.txt -vcodec copy -acodec copy "$(date +%Y-%m-%d+%H-%M-%S).mkv"
[in#0 @ 0x6f33a40] Error opening input: Invalid data found when processing input
Error opening input file concatf:concatf.txt.
Error opening input files: Invalid data found when processing input

This error occurs when I write to file "concatf.txt" link to "rtsp://".
If write to file "concatf.txt" path to simple media file - it works.
Do I need some additional options to allow network streams again?

But this is not necessary. Now I have "oneliner":

./ffmpeg \
  -hide_banner \
  -min_port 5000 -max_port 5099 \
  -t 3600 \
  -f concat -safe 0 -protocol_whitelist file,tcp,udp,rtp \
  -i <(echo file rtsp://admin:PASSWORD@192.168.0.100/stream1) \
  -vcodec copy -acodec copy \
  "$(date +%Y-%m-%d+%H-%M-%S).mkv"

Yes, it is big, it is complicated, but it works, and "ps" doesn't see password.
It works inside script, I do not need to type it by hands many times.

It works with hardware in my local network (IP-cameras), so I don't worry about possible security risks with "-protocol_whitelist".

[MasterQuestionable]

͏    Refer:
͏    ​https://github.com/FFmpeg/FFmpeg/blob/ee77ee77a1e04eebab066b73d4687ee19c234136/libavformat/concat.c#L223
͏    ​https://github.com/search?type=code&q=repo:FFmpeg/FFmpeg+%22concatf%22

͏    ----

͏    Controlling what comes from the cameras at times can be impossible.
͏    And the center gather of this information usually easily get pwned: and much unfixable.