PINENTRY_USER_DATA="foo" gpg --change-pin in bash, how easy is it for other processes to capture “foo”?
That syntax in bash sets the specified environment variable for the program you are running. Environment variables for a particular program can be read at
/proc/<pid>/environ. This means any other processes running as the same user or a user with root privileges can trivially read this value.
To mitigate this, your best bet is to run the process under a different user account. That account may be privileged or not, depending on your needs, but at least separate from other accounts that are untrusted. Ultimately, you cannot hide this type of information from the system/root.
If a program is actively trying to grab
foo, it can by searching all processes from the same user, and search
environ for any variable. This program must run with the same user as you, or from a privileged account. If
alice is running
eve cannot do this with her common user account.
This program would have to keep an active search for every new process launch, see if it's
gpg, and dump its
environ file. But the window to use the old pin is pretty small.
As you will change the PIN immediately, the old PIN loses its utility pretty fast. As soon as you enter the new PIN, the old one is useless.
Another look at this: if you are worried about another process running as you and grabbing the environment variables from GPG, you are worrying about the wrong thing. A malicious process running as you can just attach
gdb to whatever process you run, dump its memory, inject data.
So if there's something malicious running as you on the system, don't try to hide from it. Nuke the system and reinstall.