File content from env var

Question

I would like to completely avoid writing credentials to disk. I want the credentials to be read from the environment variable. But some scripts require a credential file on disk from which they read those credentials. Especially difficult to deal with it when it’s a binary, there isn’t even a way to modify the script. And there isn’t a cli option to read from elsewhere. One such example is the gam (google apps manager).

Question: is there any way to make the file that the binary expects to hold the credentials value somehow pull this value in from the environment variable?

Ideal solution should work for Linux/Unix.

Answer 1

A bash Process Substitution acts like a file:

some-program-that-reads-a-file <(echo "$MY_ENV_VAR")
#..............................^^..................^

---

Here's a demo of how a program sees the process substitution: use awk to print out its arguments:

$ awk 'BEGIN {for (i=0; i<ARGC; i++) print i, ARGV[i]}' <(echo $HOME)
0 awk
1 /dev/fd/63

---

Different shells use different syntax for process substitution

• zsh

  some-program =(echo $VAR)
  

• fish

  some-program (echo $VAR | psub)
  

• ksh, same as bash

---

If you're need a specific file, then use a FIFO:

mkfifo ~/tmp/creds-file.pem
printf '%s' "$var" > ~/tmp/creds-file.pem &

cat ~/tmp/creds-file.pem

Answer 2

Not sure this can be safely done (e.g. other process might read FIFO first), but it might be worth a try: use a FIFO and echo into it:

mkfifo ~/tmp/creds-file.pem
echo "$env_var" > ~/tmp/creds-file.pem & run_application_that_reads_from_file
rm ~/tmp/creds-file.pem