Hidden password from /proc/{pid}/cmdline or ps command output

go/base/utils.go

@@ -9,10 +9,12 @@ import (
 	"fmt"
 	"os"
 	"regexp"
+	"runtime"
 	"strings"
 	"time"
 
 	gosql "database/sql"
+	"github.com/ErikDubbelboer/gspt"
 	"github.com/github/gh-ost/go/mysql"
 	"github.com/outbrain/golib/log"
 )
@@ -94,3 +96,36 @@ func ValidateConnection(db *gosql.DB, connectionConfig *mysql.ConnectionConfig,
 		return "", fmt.Errorf("Unexpected database port reported: %+v / extra_port: %+v", port, extraPort)
 	}
 }
+
+// HiddenPasswordFromCmdline hidden password from `ps` command, Linux just change /proc/{pid}/cmdline
+func HiddenPasswordFromCmdline() {
+	// third party package `gspt` use cgo, not cross platform available
+	switch runtime.GOOS {
+	case "linux", "darwin":
+	default:
+		return
+	}
+	// replace password with `xxx`
+	var cmdline []string
+	argsLength := len(os.Args)
+	for i, arg := range os.Args {
+		switch arg {
+		// -password aaa, --password aaa
+		case "--password", "-password", "-master-password", "--master-password":
+			if i+1 < argsLength {
+				os.Args[i+1] = "xxx"
+			}
+		default:
+			// -password=aaa, --password=aaa
+			switch strings.Split(arg, "=")[0] {
+			case "--password", "-password":
+				arg = "-password=xxx"
+			case "-master-password", "--master-password":
+				arg = "-master-password=xxx"
+			}
+		}
+		cmdline = append(cmdline, arg)
+	}
+	// call third party function set process's `/proc/{pid}/cmdline`
+	gspt.SetProcTitle(strings.Join(cmdline, " "))
+}

go/cmd/gh-ost/main.go

@@ -139,6 +139,7 @@ func main() {
 	flag.CommandLine.SetOutput(os.Stdout)
 
 	flag.Parse()
+	base.HiddenPasswordFromCmdline()
 
 	if *checkFlag {
 		return