Don't let every user read the environment variables in Systemd units? #38

New Issue

greg · 2019-04-23T12:57:20Z

greg commented

2019-04-23 12:57:20 +00:00

We started discussing it in #37

I thought making the unit files not world readable is enough, let's find a good solution and use it everywhere

We started discussing it in #37 I thought making the unit files not world readable is enough, let's find a good solution and use it everywhere

raucao commented

2019-04-23 13:12:48 +00:00

From kosmos-dev@chat.kosmos.org:

Note that environment variables are not suitable for passing secrets (such as passwords, key material, …) to service processes. Environment variables set for a unit are exposed to unprivileged clients via D-Bus IPC, and generally not understood as being data that requires protection. Moreover, environment variables are propagated down the process tree, including across security boundaries (such as setuid/setgid executables), and hence might leak to processes that should not have access to the secret data.

https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment=

From `kosmos-dev@chat.kosmos.org`: > Note that environment variables are not suitable for passing secrets (such as passwords, key material, …) to service processes. Environment variables set for a unit are exposed to unprivileged clients via D-Bus IPC, and generally not understood as being data that requires protection. Moreover, environment variables are propagated down the process tree, including across security boundaries (such as setuid/setgid executables), and hence might leak to processes that should not have access to the secret data. https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Environment=

raucao added the

security

question

labels 2020-08-30 12:24:05 +00:00

raucao commented

2020-11-05 10:06:04 +00:00

Another post on the topic:

https://movingfast.io/articles/environment-variables-considered-harmful/

The gist is to just use local config files that aren't loaded into ENV vars.

Another post on the topic: https://movingfast.io/articles/environment-variables-considered-harmful/ The gist is to just use local config files that aren't loaded into ENV vars.

raucao commented

2023-03-30 09:28:45 +00:00

Closing in favor of assessing the situation use case by use case.

raucao closed this issue

2023-03-30 09:28:45 +00:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: kosmos/chef#38