Passphrasefd

Passphrasefd is a mechanism for delivering a passphrase to a process through a file descriptor (FD) rather than via a command line, environment variable, or interactive prompt. It is used in some cryptographic tools and containerized environments to minimize exposure of sensitive secrets in process listings, logs, or shell history.

Implementation typically involves a producer that obtains the passphrase from a secure source and writes it to an FD that is passed to the consumer at startup or on demand. The consumer then reads from the specified FD and uses the data as the passphrase. A common convention is to convey the FD number through an environment variable such as PASSPHRASE_FD, although other IPC methods can be used. The passphrase is generally read in a single operation and should be kept in memory only briefly, with careful handling to avoid copying or echoing. File descriptors may be created with close-on-exec (O_CLOEXEC) to prevent leakage into unrelated processes.

Usage scenarios include automating cryptographic unlocks, integrations with secret management systems, and secure handoffs between processes in containers or sandboxed environments. It complements existing approaches like SSH_ASKPASS and GPG_AGENT by enabling non-interactive passphrase delivery without relying on the terminal or environment variables.

Security considerations include least-privilege handling of the FD, ensuring the passphrase is not stored in logs, overwriting memory after use, and ensuring the FD is closed promptly. While not a universal standard, passphrasefd provides a pattern for safer programmatic access to secrets in environments where command-line exposure or environment leakage is a concern.