[josephcsible]

If it has DAC override, then it can read your credentials file just as easily as it can the environment.

[yrro]

Not if SELinux policy prevents it.