If I run a program that accepts configs from environment variables under non-privileged user userA; can a user with root access read those environment varibles ?


Usually the user root has no problems to see such variables. At least one way to do this is simply using the ps command:

# as non-privileged user
user@system$ foo=bar sleep 500

# as root
root@system# ps axe
... 0:00 sleep 500 foo=bar TERM=xterm ...

Visibility to another non-privileged account instead is usually not given.

| improve this answer | |

Yes, root can see such environment variables but the way to display them vary depending on the OS.

Under Linux, in addition the ps axe command already suggested, you might use:

$ pgrep apache | head -1
$ sudo strings -a /proc/2510/environ

On Solaris, if the UCB utilities are installed, /usr/ucb/ps axe will work, otherwise, there is a dedicated command to display environment variables:

# pargs -e 613
613:    /usr/sbin/syslogd
envp[0]: LC_COLLATE=fr_FR.UTF-8
envp[1]: LC_CTYPE=fr_FR.UTF-8
envp[2]: LC_MESSAGES=fr.UTF-8
envp[3]: LC_MONETARY=fr_FR.UTF-8
envp[4]: LC_NUMERIC=fr_FR.UTF-8
envp[5]: LC_TIME=fr_FR.UTF-8
envp[6]: PATH=/usr/sbin:/usr/bin
envp[7]: SMF_FMRI=svc:/system/system-log:default
envp[8]: SMF_METHOD=/lib/svc/method/system-log
envp[9]: SMF_RESTARTER=svc:/system/svc/restarter:default
envp[10]: TZ=Europe/Paris

AIX is providing a specific ps option to display process environments:

# ps ewww

Under HPUX, you need to attach a debugger to the process and display the _environ array contents, e.g.:

# gdb <pid>
p ((char**)_environ)[0]@10

This will display the first ten environment variables.

ps e option originates from BSD so should be available on all *BSD variants but on OS X, you should use ps -axe.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.