Quick answer

Environment variables configure processes — and sometimes leak secrets (API keys, passwords) or enable escalation. Dangerous variables like LD_PRELOAD and LD_LIBRARY_PATH can hijack privileged programs if preserved across a privilege boundary such as sudo.

What is Environment variables?#

Environment variables are key/value pairs inherited by processes. Some hold configuration; some hold secrets. A few, notably the dynamic-linker variables LD_PRELOAD and LD_LIBRARY_PATH, change how programs load libraries.

Why LinPEAS checks environment variables#

LinPEAS reads environment variables (including other processes' /proc/*/environ where readable) to surface secrets, and flags dangerous variables. If sudo is configured to preserve LD_PRELOAD, a permitted command can be turned into arbitrary root code.

What a normal configuration looks like#

Application config lives in the environment without secrets where possible; secrets are stored in restricted files. sudo drops the environment by default, so LD_PRELOAD does not carry across.

Why it can be security-sensitive#

Passwords/keys in environment variables (readable via /proc/<pid>/environ for your own processes, or others' if you have rights) are credential leaks. env_keep += LD_PRELOAD in sudoers plus any sudo-allowed binary equals root.

From highlight to verdict

Understanding the concept tells you whether a LinPEAS highlight is a real problem here. The tool flags candidates; you confirm exploitability in context, and only act where authorised.

How to check it manually#

Run these read-only commands to inspect this area yourself and validate what LinPEAS reports:

Your environment
env
A process's environment (if permitted)
cat /proc/&lt;pid&gt;/environ | tr '\0' '\n'
Check sudoers for env_keep
sudo -l | grep -i env_keep

Defensive remediation#

  • Keep secrets out of environment variables; use restricted files or a secrets manager.
  • Do not add LD_PRELOAD/LD_LIBRARY_PATH to sudo env_keep.
  • Leave sudo's default environment reset in place.

Sources & references

  1. HackTricks: Linux privilege escalation
  2. GTFOBins — abuse techniques for standard binaries
  3. PEASS-ng repository — reviewed 20260908-dffb9496