[gtk: 1/3] gtksecurememory: Request that secure memory not be dumped to disk
- From: Emmanuele Bassi <ebassi src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [gtk: 1/3] gtksecurememory: Request that secure memory not be dumped to disk
- Date: Sat, 17 Apr 2021 23:46:39 +0000 (UTC)
commit 6622ebb310c488a614627d56e931de802e2c3b55
Author: Matthew Garrett <matthewgarrett google com>
Date: Fri Apr 19 13:08:32 2019 -0700
gtksecurememory: Request that secure memory not be dumped to disk
Linux 3.4 added support for the MADV_DONTDUMP option to madvise(), which
requests that the covered memory not be included in coredumps. It makes
sense to use this to prevent cases where application crashes could
result in secrets being persisted to disk or included in dumps that are
uploaded to remote servers for analysis. I've avoided making this fatal
since there's a chance this code could be built on systems that have
MADV_DONTDUMP but run on systems that don't.
gtk/gtksecurememory.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
---
diff --git a/gtk/gtksecurememory.c b/gtk/gtksecurememory.c
index 35a6f6b875..6dff307e65 100644
--- a/gtk/gtksecurememory.c
+++ b/gtk/gtksecurememory.c
@@ -943,6 +943,19 @@ sec_acquire_pages (size_t *sz,
DEBUG_ALLOC ("gtk-secure-memory: new block ", *sz);
+#if defined(MADV_DONTDUMP)
+ if (madvise (pages, *sz, MADV_DONTDUMP) < 0) {
+ if (show_warning && gtk_secure_warnings) {
+ /*
+ * Not fatal - this was added in Linux 3.4 and older
+ * kernels will legitimately fail this at runtime
+ */
+ fprintf (stderr, "couldn't MADV_DONTDUMP %lu bytes of memory (%s): %s\n",
+ (unsigned long)*sz, during_tag, strerror (errno));
+ }
+ }
+#endif
+
show_warning = 1;
return pages;
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]