Recently, I have been looking for the possibility to pass sensitive information from one process to another (at process startup time) without passing it through the command line or without using a filesystem entry. This is on Linux but the question applies to other systems, too.
In particular, the password to access a MySQL server shall be passed down from a script to the MySQL client. To do so, you can pass it over the command line (
-pPASSWORD), but this is nasty as a simple process listing will then reveal the password to all other users. In this precise case, the MySQL client program is friendly enough to overwrite the command line text, replacing the visible password string by
XXX but this is a smelly solution.
I thought about use the process environment instead. The script sets the password in the process environment, the started subprocess can then read it from there. Indeed, the MySQL client allows this and looks for the environment variable
MYSQL_PWD. This looks pretty secure and also elegant, as a process environment cannot be consulted by anyone but root and the process owner, at least as far as I know.
However, the MySQL 5.1 manual states:
This method of specifying your MySQL password [via the environment] must be considered extremely insecure and should not be used. Some versions of
psinclude an option to display the environment of running processes. On some systems, if you set
MYSQL_PWD, your password is exposed to any other user who runs ps. Even on systems without such a version of
ps, it is unwise to assume that there are no other methods by which users can examine process environments."
The question then is: Is passing sensitive data through the process environment really insecure? Are there systems that allow consultation of another process' environment with no verification of permissions? Clearly, the superuser can grab the password at will, but then again, he doesn't need it in the first place.