{"record":{"id":"074cbbdac365fdff","repo":"NationalSecurityAgency/ghidra","slug":"unable-to-delete-password-file","errorCode":null,"errorMessage":"Unable to delete password file: {}","messagePattern":"Unable to delete password file: (.+?)","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java","lineNumber":536,"sourceCode":"\t\t\tif (repeatPass[i] != password[i]) {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t}\n\t\treturn true;\n\t}\n\n\t/**\n\t * Make sure password data, stored either in the heap or in a temporary file, is scrubbed\n\t * @throws IOException if the password file cannot be deleted\n\t */\n\tprivate void cleanupPasswordData() throws IOException {\n\n\t\tclearPasswordData(adminPasswordData);\n\t\tadminPasswordData = null;\n\n\t\tif (passwordFile != null) {\n\t\t\tif (!passwordFile.delete()) {\n\t\t\t\tthrow new IOException(\n\t\t\t\t\t\"Unable to delete password file: \" + passwordFile.getAbsolutePath());\n\t\t\t}\n\t\t\tpasswordFile = null;\n\t\t}\n\t}\n\n\t/**\n\t * Servers that allow SSL connections are required to have a certificate that allows it to\n\t * authenticate itself to users.  The BSim server does not authenticate itself to clients, but\n\t * a certificate must still be present.  We generate a self-signed certificate.\n\t * @param certFile will hold the public portion of the generated certificate\n\t * @param passFile will hold the private portion\n\t * @throws IOException if the password file cannot be opened for writing\n\t * @throws GeneralSecurityException if the keystore cannot be created\n\t */\n\tprivate void generateSelfSignedCertificate(File certFile, File passFile)\n\t\t\tthrows IOException, GeneralSecurityException {\n","sourceCodeStart":518,"sourceCodeEnd":554,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/BSimControlLaunchable.java#L518-L554","documentation":"Thrown by cleanupPasswordData when File.delete() returns false for the temporary password file during scrubbing. The tool scrubs the temp file holding the admin password; a failed delete means sensitive material may remain on disk, so it raises rather than silently continuing.","triggerScenarios":"The temp password file cannot be removed because another process holds it open, permissions were changed, or it was already deleted (line 536).","commonSituations":"Concurrent process holding the file, antivirus/indexer locking files on Windows, restrictive temp-dir permissions, or the file removed out-of-band.","solutions":["Ensure no other process (postgres init, AV, indexer) holds the temp file open.","Verify delete permission on the temp directory (java.io.tmpdir).","Manually remove the leftover temp file (bsim*.dat) if scrub failed, to avoid leaving the password on disk."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Ensure the temp dir is writable/deletable before starting password setup.\nFile tmp = new File(System.getProperty(\"java.io.tmpdir\"));\nif (!tmp.canWrite()) {\n    System.err.println(\"Temp dir not writable; password scrub may fail: \" + tmp);\n    return;\n}","typeGuard":null,"tryCatchPattern":"try {\n    launchable.cleanupPasswordData();\n} catch (IOException e) {\n    if (e.getMessage().startsWith(\"Unable to delete password file:\")) {\n        // Scrub failed: locate and manually remove the bsim*.dat file to avoid leaving secrets.\n        log.warn(\"Manual cleanup required: \" + e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Verify the temp directory permits delete before starting password operations.","Close/release any file handles on temp password files promptly.","On scrub failure, manually remove leftover bsim*.dat files to protect secrets."],"tags":["security","password","filesystem","postgresql"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}