When I was at university I was taught that I could request memory to be locked when allocating it. That this would stop it being swapped to disk. This is not true as it will swap-out when a suspend to disk is done. (The lock bit is a request, it is intended for performance, not security, and should only be used if you know what you are doing.)
So I was wondering if there is a way to allocate secure memory. I had two ideas, but I can not see if they are implemented:
secure lock: will prevent hibernation, so could cause problems to the rest of the system, unless there is a way to signal the process, to tell it to release the memory. But then what if it does not.
request volatile/transient memory: I am using volatile to mean even more volatile than RAM as the system can just un-map the memory, without swapping, or warning. This could cause a memory fault, that the application must handle.
Large allocations would be used for decryption caches, and could be un-mapped, but can also be rebuilt. For the pass-phrases, these would be stored in small allocations, in the hope that they will not be un-mapped (except for hibernation). If a pass-phrase is un-mapped then user interaction is needed.
Does anything like this exist, including other alternatives?
I am using Debian9 Gnu/Linux, but would also be interested in what other operating systems do.