4 ms·
My problem is with owner-of-PID, if you have directory traversal as root... good luck I guess. You can store secrets in a process belonging to a different PID
by SonOfLilit 4y ago
My problem is with owner-of-PID, if you have directory traversal as root... good luck I guess.
You can store secrets in a process belonging to a different PID and get them with some kind of RPC.
- tptacek 4y agoNow that process has to get its secret from somewhere. At some point, you're just recapitulating the design of Hashicorp Vault. But even if you're using Vault, you're most likely injecting secrets as environment variables.
- SonOfLilit 4y agoBelonging to a different user* It can get it from a file that isn't readable by the user that runs remote-accessible code.