Linux Shell Code Standard I/O Concurrency/Exclusivity

[cprince]

I'm writing a web front end to a PKI system for our users. The web front end will generate a private key and certificate signing request(CSR) that will be uploaded to a Certificate Authority for signing. I'm using the PHP shell_exec command:

$output = shell_exec("openssl req -nodes -newkey rsa:2048 -nodes -subj \"/C=US/ST=SomeState/L=SomeCITY/O=SomeCompany/OU=SomeOU/CN=test.domain\" -keyout /dev/stdout");

The variable $output contains both the private key and the CSR. Before I'm going any further, I have a question: Because I'm getting my data from standard output, is it possible for another program to write something else to stdout while openssl execute? What happen if two users visit the PHP page at the same time? I know the possibility is very remote, but I just want to make sure that nothing can mess up the private key and CSR before it is entered into a database. Thanks in advance!

P.S. In case you're wondering, the private key will be encrypted with the sha1sum of a user supplied password using MySQL encrypt function.

 

[Markbnj]

Well, each time shell_exec executes I'm assuming you'll get a new process created, so your users shouldn't be stepping on each other. I don't know enough php to advise of any peculiarities in shell_exec, however.

On the question of stdout being secure... the standard output is associated with one and only one process id. No other running process is going to accidentally inject output into that pipe. I'm not sure whether a malicious process could do so.

 

[cprince]

Thanks for the reply, Markbnj. You're absolutely correct, standard I/O--/dev/stdout, /dev/stdin, and /dev/stderr are symbolic links to /proc/self/fd/N, where N is 0 for stdin, 1 for stdout, and 2 for stderr. /proc/self is a symbolic link to the current running process, which allows the process to look at itself without knowing its process ID, so no other processes should have access to a particular process' standard I/O.