Let's say you have a program you want to run unattended, as root, which requires a secret (such as a passphrase; something you don't want other people to find out), which can be read from an environment variable. One way of accomplishing this would be to create a script like the following, and run it from root's crontab.
#!/bin/bash export SECRET='my_secret' /usr/bin/some_program export SECRET=
Okay, so I can think of two security issues here.
First, someone could find the value of
$SECRET by reading the script. Using
chmod 700 should take care of that.
Second, someone could use something like
ps ae while
some_program is running. However, if the script is running as root, only root (or sudoers) can see its environment, right?
Am I correct in believing the value of
$SECRET can only be found by root or sudoers? Are there other security issues?
And, to make all this a little less abstract, this is what got me thinking.