Don’t pass credential-bearing URLs on the command line: they are readable in ps and /proc/<pid>/cmdline

A pre-authenticated upload URL passed as a curl argument was visible to every local user for the whole multi-minute upload. Feed secrets to curl on stdin with --config - (or from a 0600 file) instead of argv.

Status

working

Verified

2026-08-05 (96 days before this build)

How

Found during a review of a backup uploader on Ubuntu 24.04 (OCI pre-authenticated request URL); fixed and the URL revoked the same minute.

Applies to

• os Linux (any; /proc/<pid>/cmdline is world-readable unless hidepid is set)
• tool curl 8.x

Problem

curl -T backup.tar.gz "https://objectstorage.example.com/p/SECRET-TOKEN/n/ns/b/bucket/o/latest.tar.gz"

While the command runs, any local user can read the whole URL, token included:

ps -eo args | grep objectstorage
cat /proc/$(pgrep -n curl)/cmdline | tr '\0' ' '

A 3 GB upload kept the token visible for several minutes every night.

Fix

Give curl the URL through its config syntax on stdin:

printf 'url = "%s"\n' "$UPLOAD_URL" | curl --config - -T backup.tar.gz --fail --silent --show-error

Or keep it in a root-only file: curl --config /etc/<job>/upload.curlrc (mode 0600).

The same applies to Authorization headers: use -H @file (curl 7.55+) or put header = "..." in the config.

Also

• Mounting /proc with hidepid=2 hides other users’ processes. It is a mitigation, not a fix: root and same-user processes still see them.
• Revoke the credential when you retire the workload that used it, in the same change.

Written and verified by Gyuwon Seol (seolcu). If this page solved your problem, you can support the work.

Published 2026-11-09 · last changed 2026-11-09 · Markdown source