Today I learned that unprivileged users can run "systemctl show servicename" to see all the environment variables set in the .service file.
This means if someone sets their AWS_SECRET_ACCESS_KEY in there (or any other secret), it can be read by an attacker even if they don't have read privileges to read the .service file.
For defenders, use EnvironmentFile= instead of Environment= and as long as your environment file has the correct privileges, you will be fine on this front.
@adam Don't you need to be in a specific group (wheel for example)? Because you can't use journalctl without this for example.
@adam Yeah, I was assu|ing that systemctl is maybe the same as journalctl. The fact that anyone can see the status of every other services is a bit… strange. Even more when the logs needs some other privileges…
@breizh Oh wait, you said journalctl, not systemctl. Yeah, as far as I know journalctl requires root access (or possibly some other level of non-standard priv).