1

I'm writing a simple shell script that reads a PIN once (into a variable) and uses it to call several commands that needs this pin. It is possible to instruct those commands to read PIN from stdin, but I don't know how to send the variable value to a pipe without revealing it in a process list. Usual way - using echo "$PIN" - would perform a substitution so the value of PIN would be visible to other users via process list.

Is there a command that accepts a variable name and outputs that variable's value to stdout? Or is there some other way?

2
  • 1
    echo is usually a built-in utility and won't show up in the process list.
    – Kusalananda
    Sep 13, 2017 at 9:26
  • I haven't realized that, you are right. I will leave this question open for answers that would solve the minor case when echo is not built in. Sep 13, 2017 at 9:30

1 Answer 1

4

As echo is builtin in all shells, it won't show in the process list.

It is however unreliable for arbitrary data

You can use printf '%s\n' "$PIN" for something more reliable, but note that some pdksh-based shells still don't have printf builtin. The work around for those is to use print -r -- "$PIN". print is available in zsh, and all implementations of ksh, but is not a standard command.

You can also use a here-document:

cmd << EOF
$PIN
EOF

(or here-string (cmd <<< "$PIN") in zsh and a few other shells now). But note that with most implementations, here-documents are implemented with temporary files, so the PIN may be recoverable offline if the file was committed to disk.

It's better not to export PIN to the environment if you can avoid it as it's more easily discoverable by other processes (seen in /proc/pid/environ which processes with the same uid can read, while there are often more restrictions as to what can read the memory of another process). ps on some (rare) systems also let you see the environment of any process.

Once in the environment though, on some systems, there's a printenv command to display its value:

printenv PIN

Or you can always use perl:

perl -le 'print $ENV{PIN}'
1
  • I have corrected the quoting. Sep 13, 2017 at 9:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .