diff --git a/lib/exec/config.go b/lib/exec/config.go
index 47088f2..f20d89a 100644
--- a/lib/exec/config.go
+++ b/lib/exec/config.go
@@ -26,9 +26,11 @@
 	// Set sets the value for the key.  If the key already exists in the
 	// config, its value is overwritten.
 	Set(key, value string)
-	// Get returns the value for the key.  If the key doesn't exist in the
-	// config, Get returns an error.
+	// Get returns the value for the key. If the key doesn't exist
+	// in the config, Get returns an error.
 	Get(key string) (string, error)
+	// Clear removes the specified key from the config.
+	Clear(key string)
 	// Serialize serializes the config to a string.
 	Serialize() (string, error)
 	// MergeFrom deserializes config information from a string created using
@@ -64,6 +66,12 @@
 	return v, nil
 }
 
+func (c cfg) Clear(key string) {
+	c.Lock()
+	defer c.Unlock()
+	delete(c.m, key)
+}
+
 func (c cfg) Serialize() (string, error) {
 	var buf bytes.Buffer
 	c.RLock()
diff --git a/lib/exec/config_test.go b/lib/exec/config_test.go
index 140f10b..14ffd7f 100644
--- a/lib/exec/config_test.go
+++ b/lib/exec/config_test.go
@@ -27,6 +27,8 @@
 	checkAbsent(t, c, "food")
 	c.Set("foo", "baz")
 	checkPresent(t, c, "foo", "baz")
+	c.Clear("foo")
+	checkAbsent(t, c, "foo")
 }
 
 // TestSerialize checks that serializing the config and merging from a
diff --git a/lib/modules/exec.go b/lib/modules/exec.go
index ab893d8..6d45f6c 100644
--- a/lib/modules/exec.go
+++ b/lib/modules/exec.go
@@ -134,7 +134,7 @@
 		return nil, err
 	}
 
-	handle := vexec.NewParentHandle(cmd, vexec.ConfigOpt{Config: sh.Config})
+	handle := vexec.NewParentHandle(cmd, vexec.ConfigOpt{Config: sh.config})
 	eh.stdout = stdout
 	eh.stderr = stderr
 	eh.stdin = stdin
diff --git a/lib/modules/shell.go b/lib/modules/shell.go
index 7f3c194..535cc01 100644
--- a/lib/modules/shell.go
+++ b/lib/modules/shell.go
@@ -62,7 +62,7 @@
 	handles      map[Handle]struct{}
 	credDir      string
 	startTimeout time.Duration
-	Config       exec.Config
+	config       exec.Config
 }
 
 type commandDesc struct {
@@ -98,7 +98,7 @@
 		cmds:         make(map[string]*commandDesc),
 		handles:      make(map[Handle]struct{}),
 		startTimeout: time.Minute,
-		Config:       exec.NewConfig(),
+		config:       exec.NewConfig(),
 	}
 	if flag.Lookup("test.run") != nil && os.Getenv(consts.VeyronCredentials) == "" {
 		if err := sh.CreateAndUseNewCredentials(); err != nil {
@@ -283,6 +283,25 @@
 	delete(sh.env, key)
 }
 
+// GetConfigKey returns the value associated with the specified key in
+// the Shell's config and an indication of whether it is defined or
+// not.
+func (sh *Shell) GetConfigKey(key string) (string, bool) {
+	v, err := sh.config.Get(key)
+	return v, err == nil
+}
+
+// SetConfigKey sets the value of the specified key in the Shell's
+// config.
+func (sh *Shell) SetConfigKey(key, value string) {
+	sh.config.Set(key, value)
+}
+
+// ClearConfigKey removes the speficied key from the Shell's config.
+func (sh *Shell) ClearConfigKey(key string) {
+	sh.config.Clear(key)
+}
+
 // Env returns the entire set of environment variables associated with this
 // Shell as a string slice.
 func (sh *Shell) Env() []string {
diff --git a/lib/signals/signals_test.go b/lib/signals/signals_test.go
index 5588610..4aff7fe 100644
--- a/lib/signals/signals_test.go
+++ b/lib/signals/signals_test.go
@@ -340,9 +340,9 @@
 	configServer, configServiceName, ch := createConfigServer(t)
 	defer configServer.Stop()
 	sh.SetVar(consts.VeyronCredentials, childcreds)
-	sh.Config.Set(mgmt.ParentNameConfigKey, configServiceName)
-	sh.Config.Set(mgmt.ProtocolConfigKey, "tcp")
-	sh.Config.Set(mgmt.AddressConfigKey, "127.0.0.1:0")
+	sh.SetConfigKey(mgmt.ParentNameConfigKey, configServiceName)
+	sh.SetConfigKey(mgmt.ProtocolConfigKey, "tcp")
+	sh.SetConfigKey(mgmt.AddressConfigKey, "127.0.0.1:0")
 	h, err := sh.Start("handleDefaults", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)
diff --git a/runtimes/google/rt/mgmt_test.go b/runtimes/google/rt/mgmt_test.go
index 512303c..fc39919 100644
--- a/runtimes/google/rt/mgmt_test.go
+++ b/runtimes/google/rt/mgmt_test.go
@@ -291,9 +291,9 @@
 	configServer, configServiceName, ch := createConfigServer(t, r)
 	sh := modules.NewShell(appCmd)
 	sh.SetVar(consts.VeyronCredentials, childcreds)
-	sh.Config.Set(mgmt.ParentNameConfigKey, configServiceName)
-	sh.Config.Set(mgmt.ProtocolConfigKey, "tcp")
-	sh.Config.Set(mgmt.AddressConfigKey, "127.0.0.1:0")
+	sh.SetConfigKey(mgmt.ParentNameConfigKey, configServiceName)
+	sh.SetConfigKey(mgmt.ProtocolConfigKey, "tcp")
+	sh.SetConfigKey(mgmt.AddressConfigKey, "127.0.0.1:0")
 	h, err := sh.Start("app", nil)
 	if err != nil {
 		t.Fatalf("unexpected error: %s", err)