Information disclosure?

[freebsd-security at dfmm.org]

> For some reason, I thought little about the "clear" command today.. 
> Let's say a privileged user (root) logs on, edit a sensitive file (e.g, 
> a file containing a password, running vipw, etc) .. then runs clear and 
> logout. Then anyone can press the scroll-lock command, scroll back up 
> and read the sensitive information.. Isn't "clear" ment to clear the

I've thought about this also - I think that if it's really a concern, the 
thing to do is to just disable the kernel-level text console scrollback 
completely and use screen(1) or something similar for those times when you 
do want scrollback.

alternatively,
alias clear='for i in {1..SC_HISTORY_SIZE} ; do echo "" ; done'


  -Jason