From 6d1f3f37637bff257c6ada234b3e9df2917d6e5e Mon Sep 17 00:00:00 2001 From: Gabriel Brown Date: Fri, 21 Aug 2026 17:43:33 -0400 Subject: [PATCH] Keep the MOK password off the command line it was promised off of The comment above the prompt says the password never reaches a command line; --generate-hash="$first" put it on one, world-readable in /proc//cmdline while mokutil ran. It now arrives on stdin, and the hash is taken from the last output line because mokutil prints its prompts to stdout too. --- setup/scripts/interview | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/setup/scripts/interview b/setup/scripts/interview index f604432..a9cebcf 100755 --- a/setup/scripts/interview +++ b/setup/scripts/interview @@ -122,7 +122,12 @@ if [[ -n "$nvidia_card" ]]; then fi second="$(gum input --password --header "MOK password again")" if [[ "$first" == "$second" ]]; then - mok_hash="$(mokutil --generate-hash="$first")" + # Fed on stdin, never as an argument: an argument sits + # in /proc//cmdline for any local process to read + # while mokutil runs. mokutil prints its two prompts on + # stdout too, so the hash is the last line. + mok_hash="$(printf '%s\n%s\n' "$first" "$first" \ + | mokutil --generate-hash | tail -n 1)" break fi printf 'Those did not match.\n'