Re:The Twelve-Factor App
by derefr on Thursday October 12, 2023 @12:42PM
(#37859589)
Presumably because /proc/$PID/environ exists and can be read by the user that owns the process — which means that any attacker that can figure out how to spawn an arbitrary subprocess running as the daemon user (a pretty common vulnerability class!) can exfiltrate all your env-vars.
It's similar to the reason that you're not supposed to supply passwords on the command-line (/proc/$PID/cmdline exists), but instead either read them from stdin, or do the big dance of
1. creating a file that contains the password, is owned by root, and is 0400;
2. having your daemon start off running as root for just long enough to read the password into process memory;
3. then having your daemon drop privileges before doing any work, so that someone exploiting the daemon won't have the privilege as the "do the work" user to read the file with the password in it.
It's similar to the reason that you're not supposed to supply passwords on the command-line (/proc/$PID/cmdline exists), but instead either read them from stdin, or do the big dance of
1. creating a file that contains the password, is owned by root, and is 0400;
2. having your daemon start off running as root for just long enough to read the password into process memory;
3. then having your daemon drop privileges before doing any work, so that someone exploiting the daemon won't have the privilege as the "do the work" user to read the file with the password in it.