4 ms·

systemd 247+ now discourages using env vars for secrets, because there are the LoadCredential and related options that are much more secure, with better isolati

• candiddevmike 2y ago
  I would argue that's a systemd quirk due to D-Bus design. Environment variables for processes in Linux for the most part cannot be read by processes of non-root users, so out of the box they are "secure" for the user starting the process.
  • NewJazz 2y ago
    They are also inherited by child processes. Though, so is the mount namespace.
  • pphysch 2y ago
    Right, but dumping envs is a common debugging and attack vector.
• asqueella 2y ago
  Thanks, wouldn’t think of environment being shared via DBus: > Note that environment variables are not suitable for passing secrets (such as passwords, key material, …) to service processes. Environment variables set for a unit are exposed to unprivileged clients via D-Bus IPC, and generally not understood as being data that requires protection. > Moreover, environment variables are propagated down the process tree, including across security boundaries (such as setuid/setgid executables), and hence might leak to processes that should not have access to the secret data.