2010/6/14 Peter Jeremy <peterjeremy_at_acm.org>: > On 2010-Jun-13 10:07:15 +0200, Dag-Erling Smørgrav <des_at_des.no> wrote: >>You always overwrite passphrases, keys etc. as soon as you're done with >>them so they don't end up in a crash dump or on a swap disk or >>something. > > Which brings up an associated issue: By default, mlock(2) can only be > used by root processes. It would be really handy if non-privileged > processes could lock small amounts of VM so they can securely handle > passwords, passphrases, keys, etc. MAC offers the option of allowing > non-root processes access to mlock() but doesn't provide any > restrictions on the amount of memory they can lock. Interesting! >From an admin point of view, this behavior could them be enabled or disabled via sysctl(8), and this sysctl variable could define what "small" means exactly (#nr of pages per process maybe?) Another sysctl variable should probably define how many pages can be locked in general by all non-privileged processes, to prevent malicious programs like fork bombs to mlock the whole memory. > Peter Jeremy -cpghost. -- Cordula's Web. http://www.cordula.ws/Received on Mon Jun 14 2010 - 00:00:55 UTC
This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:40:04 UTC