Environment Variables Considered Harmful for Your Secrets

Re:Environment Variables Considered Harmful for Your Secrets by geocar on Friday January 02, 2015 @05:43AM (#8826339)

    BEGIN {
        $API = new Backend($ENV{credentials});
        delete $ENV{credentials};
    };

Filesystem permissions do not make it possible for a program to internally partition access to those credentials unless you (a) start it as root, or (b) delete the credentials file after reading it.

[ Parent | on HN ]

Re:Environment Variables Considered Harmful for Your Secrets by icebraining on Friday January 02, 2015 @07:21AM (#8826495)

A user process can start subprocesses under different users, without access permissions to the files owned by parent. The most obvious way to do so is to use sudo.

[ Parent | on HN ]

Re:Environment Variables Considered Harmful for Your Secrets by geocar on Friday January 02, 2015 @04:27PM (#8828652)

Using a setuid helper (even if it's called sudo) is still starting a program as root.

[ Parent | on HN ]

Re:Environment Variables Considered Harmful for Your Secrets by icebraining on Friday January 02, 2015 @05:33PM (#8828946)

Not necessarily; sudo on Fedora has CAP_SETUID instead of the setuid bit, so it doesn't actually run as root.

http://fedoraproject.org/wiki/Features/RemoveSETUID

[ Parent | on HN ]

Re:Environment Variables Considered Harmful for Your Secrets by ptx on Sunday January 04, 2015 @12:39PM (#8835109)

But CAP_SETUID, unless I'm confusing it with something else, can be used to set the UID to 0 and thereby gain all the same privileges as if the program had been started as root, can't it? Presumably it has some advantage that I'm not getting – does it have to be combined with e.g. SELinux to be useful?

[ Parent | on HN ]