How to send variable value to pipe while hiding it from the process list?

Question

I'm writing a simple shell script that reads a PIN once (into a variable) and uses it to call several commands that needs this pin. It is possible to instruct those commands to read PIN from stdin, but I don't know how to send the variable value to a pipe without revealing it in a process list. Usual way - using echo "$PIN" - would perform a substitution so the value of PIN would be visible to other users via process list.

Is there a command that accepts a variable name and outputs that variable's value to stdout? Or is there some other way?

Answer 1

As echo is builtin in all shells, it won't show in the process list.

It is however unreliable for arbitrary data

You can use printf '%s\n' "$PIN" for something more reliable, but note that some pdksh-based shells still don't have printf builtin. The work around for those is to use print -r -- "$PIN". print is available in zsh, and all implementations of ksh, but is not a standard command.

You can also use a here-document:

cmd << EOF
$PIN
EOF

(or here-string (cmd <<< "$PIN") in zsh and a few other shells now). But note that with most implementations, here-documents are implemented with temporary files, so the PIN may be recoverable offline if the file was committed to disk.

It's better not to export PIN to the environment if you can avoid it as it's more easily discoverable by other processes (seen in /proc/pid/environ which processes with the same uid can read, while there are often more restrictions as to what can read the memory of another process). ps on some (rare) systems also let you see the environment of any process.

Once in the environment though, on some systems, there's a printenv command to display its value:

printenv PIN

Or you can always use perl:

perl -le 'print $ENV{PIN}'