4

this question is specific to Unix and Linux. but it is programming and security, too.

my program will get a clear password or decryption key by one of a few ways (decrypting a password file, asking an agent, etc) and i want to be sure it cannot be written to swap space before it can be expunged from memory after using it. i think this means getting unswappable address space. but that normally needs root permission and my program needs to run as non-root. can this be done portably in Unix? is it hopeful in Linux?

configuring the system to have no swap space is not an option as the user of the program probably does not have such authority and while this might make the system more secure not all systems can do this.

i can do this part in C though a way to do it in Python3 would be nice, too.

can my non-root process get a few non-swapped pages for security?

can i prevent this process from being suspended? better to quit than a clear password written to swap.

3

On Linux use mlock http://linux.die.net/man/2/mlock

mlock() and mlockall() respectively lock part or all of the calling process's virtual address space into RAM, preventing that memory from being paged to the swap area.

The man page has more details.

0

I must first mention that I am absolutely no specialist in security.

For the python part, It seems like wrapping mlock into python is not difficult using ctypes. From the limits and permissions section of the man for mlock, it seems that a regular user can lock a limited amount of memory. Running uname -a on my system gives me max locked memory (kbytes, -l) 64 which should be enough for storing a password (but you should probably take care of overflow).

For hibernation, you cannot handle the SIGSTOP signal, but if your system is graceful, you may receive SIGTSTP (see [can a process be frozen temporarily in linux]). In case you only receive SIGSTOP, [are-passwords-stored-in-memory-safe] seems to say you are doomed unless disk encryption is used, which may not be a valid solution for you. You can however maybe detect a breach by handling SIGCONT, but this may be too late.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.