Also, /proc/<pid>/environ. There are rules on who owns this file (root, or the executing user) based on the suid bit. Regardless, you are now depending on linux permissions to protect your secrets, which begs the question: Why not just trust the filesystem? Even if /proc/<pid>/environ didn't exist, you could go through /proc/<pid>/mem to find secrets.

It seems that this is designed to protect you from untrusted execution environments, which I don't see as feasible. What am I missing?

> It seems that this is designed to protect you from untrusted execution environments, which I don't see as feasible. What am I missing?

Shared web hosting where you share a physical machine with other users. Not everyone is into the VM craze these days, thank god

Running

  ps auxwwe

on Linux, Mac OS X, and other Unix-en will show all processes for all users with their complete environment.

Environment variables should not be used to share secrets.

Testing on Linux, if ran as root it does, but if you are running ps auxwwe as normal user, it is only showing env variables for that user.

On FreeBSD, at least, the ability to see processes belonging to other {g,u}id's can be turned off via a sysctl.