Read host keys from environment variables

[Theo de Raadt]

Darren Tucker via openssh-unix-dev <openssh-unix-dev at mindrot.org> wrote:

> An environment variable that is inherited by the child process is also
> generally visible to any other user.  If you're proposing encrypting
> the environment variables: in order to do that you also have to have
> the decryption keys also available to those child processses in such a
> way that is *also* not recoverable by other users.
> 
> How do you pass a (private! secret!) host key to the other sshds in a
> way that is not recoverable by an arbitrary user on the same system?
> Stuffing the host key from the environment into a root-owned host key
> file inside the container at startup time seems far less dangerous and
> probably works already with a simple shell one-liner.

No kidding.  The proposal seems to be unaware that execve(2) will move
all the environment, and that there is no mechanism to stop this, and
only very poor methods to audit if it has happened.  The purpose of
environment model is to spread variables to processes, which is exactly
what you don't want with keys.  The filesystem's security model is being
used intentionally.