0

I would like to completely avoid writing credentials to disk. I want the credentials to be read from the environment variable. But some scripts require a credential file on disk from which they read those credentials. Especially difficult to deal with it when it’s a binary, there isn’t even a way to modify the script. And there isn’t a cli option to read from elsewhere. One such example is the gam (google apps manager).

Question: is there any way to make the file that the binary expects to hold the credentials value somehow pull this value in from the environment variable?

Ideal solution should work for Linux/Unix.

2 Answers 2

1

A bash Process Substitution acts like a file:

some-program-that-reads-a-file <(echo "$MY_ENV_VAR")
#..............................^^..................^

Here's a demo of how a program sees the process substitution: use awk to print out its arguments:

$ awk 'BEGIN {for (i=0; i<ARGC; i++) print i, ARGV[i]}' <(echo $HOME)
0 awk
1 /dev/fd/63

Different shells use different syntax for process substitution

  • zsh
    some-program =(echo $VAR)
    
  • fish
    some-program (echo $VAR | psub)
    
  • ksh, same as bash

If you're need a specific file, then use a FIFO:

mkfifo ~/tmp/creds-file.pem
printf '%s' "$var" > ~/tmp/creds-file.pem &

cat ~/tmp/creds-file.pem
5
  • Thanks for that Glenn! Perhaps I don’t understand something.. if some-program-that-reads-a-file on a specific place on disk (for example ~/tmp/creds-file.pem) and this program is a binary. How can I make this file (creds-file.pem) read from env var? Jul 4 at 1:55
  • 1
    process substitution is from ksh originally in the 80s. zsh supports the same pipe-based <(...) and >(...). =(...) is an additional form that uses a temp file instead, so not one the OP would want if they want to avoid the data be stored on disk (other than swap). Jul 4 at 14:12
  • In fish, psub also uses temp files. They tried using pipes, but that can't work the way they're doing it without deadlock for large values. Jul 4 at 14:12
  • Remember echo can't be used for arbitrary data. Jul 4 at 14:14
  • 1
    mkfifo -m 600 to restrict access to that fifo would make sense here. Jul 4 at 14:17
0

Not sure this can be safely done (e.g. other process might read FIFO first), but it might be worth a try: use a FIFO and echo into it:

mkfifo ~/tmp/creds-file.pem
echo "$env_var" > ~/tmp/creds-file.pem & run_application_that_reads_from_file
rm ~/tmp/creds-file.pem

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.