[lkml]   [2023]   [Nov]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] exitz syscall
On Sun, 12 Nov 2023 at 07:44, Theodore Ts'o <> wrote:
> How about adding a flag MLOCK_ZERO_ON_FREE used by the mlock2() system
> call? The number of pages which an unprivileged process can lock is
> already capped via RLIMIT_MEMLOCK (or else mlock would be it own
> denial of service attack). That way if process dies from crash, the
> keys would be zero'ed.

Yes, that is a lot better as an interface.

However, it still needs to also make sure that the memory in question
is not file-backed etc. Which the patch I saw didn't seem to do

End result: as it was, that exitz patch was not helping security. It
was anything but.


 \ /
  Last update: 2023-11-20 13:57    [W:0.080 / U:0.592 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site