4 ms·

Inherit environment variables from PID 1 by reading /proc/1/environ

• sigmonsays 4y ago
  where do you set variables on pid1 ? I dont fully get this use case yet..
  • pxx 4y ago
    Docker.
    • sigjuice 4y ago
      Or the kernel command line https://www.kernel.org/doc/html/v5.15/admin-guide/kernel-parameters.html https://www.kernel.org/doc/html/v5.15/admin-guide/kernel-par... parameters with ‘=’ go into init’s environment
  • chatmasta 4y ago
    It's pretty niche (and hacky). My use case is debugging CI runners by connecting to them via a reverse shell [0]. I want to manually run CI commands, but my reverse shell drops me into a new process without any of the same environment variables available to it that are made available by the CI platform to the runner. So I wanted a command I could paste to quickly inherit those environment variables and run the CI scripts that depend on them. [0] https://github.com/milesrichardson/shonion https://github.com/milesrichardson/shonion
• zokier 4y ago
  Reminds me of the fun fact that on Linux env vars are not really key-value, but just a list of strings; it's just a convention by libc to parse them as key-value by splitting on =. If you don't care about compatibility you could hypothetically use any format you want for env
  • Hello71 4y ago
    afaik the linux kernel doesn't read environment variables, but it does write some: processes spawned by the kernel, such as init, modprobe, and request_key, start with some pre-defined environment variables, like HOME=/ TERM=linux PATH=/sbin:/usr/sbin:/bin:/usr/bin.
  • maxbond 4y ago
    Well, it's a key-value data structure, serialized in the way you describe. You could say that a JSON object wasn't a key-value structure by the same logic. It's the same way for structures serialized in binary rather than text, like BSON objects. You can think of a native dictionary as a declarative structure where each of the pairs "happen" simultaneously. A serialized structure is necessarily imperative because it must be an ordered series of bytes that are evaluated in sequence; it must be in order to be written to disk or sent across the network (with /proc being a sort of hybrid, IPC implemented as a virtual filesystem). So we generally need to convert our dictionaries into lists to serialize them. You might think of something like sending an entire SQLite database as an exception to this rule, but there's an equivalent perspective that it is an example of the rule instead. Lists of key-value pairs and dictionaries of key-value pairs are duals of each other so you're free to take the interpretation you prefer.
    • deleted 4y ago
      [deleted]
  • nikeee 4y ago
    This seems similar to the way command like arguments work on windows. On Linux, the system call für spawning a process uses a string array for them. On windows, it's a single string. The string needs to be parsed by the application, making escape sequences in command line arguments implementation defined by the compiler/runtime/etc. https://nullprogram.com/blog/2022/02/18/ https://nullprogram.com/blog/2022/02/18/ Some examples are here: https://daviddeley.com/autohotkey/parameters/parameters.htm#WINNOSTANDARD https://daviddeley.com/autohotkey/parameters/parameters.htm#...
    • 4y ago
• kazinator 4y ago
  This is a poor hack that will backfire for someone. The CI process set up a certain environment for a reason. It purged some variables, and possibly altered others. I'm likely guessing right that if, for instance, you take the PATH from /proc/pid/1 and install that as your PATH, your CI process may run into trouble, like not being able to find needed utilities. That you need superuser privileges to get at these variables should be a red flag.
  • theamk 4y ago
    They are not touching original CI process, they are only modifying their own SSH session. And they want to run CI commands from manual SSH process, so taking PATH (and everything else) from the original CI process is exactly what they want -- this is all part of the game for SSH process to be a real "CI" runner.
• bhawks 4y ago
  Kind reminder that you probably want to use the hidepid argument to prevent any sensitive data leaking through environment or command line arguments in a production server. (Things like API keys, passwords, and so on). It is a typical bad assumption that the only thing that can read my command line is my process and the only my process children can read my env variables.
• sysbot 4y ago
  i used this to restart a process and resume its states by storing just enough data from previous process.