Does the isolation between virtual memory address spaces of different processes not apply to privileged process and to swap?

Question

From The Linux Programming Interface

The virtual memory page containing the data may be swapped out (unless it is locked in memory using mlock() or similar), and could then be read from the swap area by a privileged program.

I learned that the virtual memory address space of a process is not accessible to another process. The above quote makes me wonder

• Does that isolation claim does not apply to another privileged process?

• Does that not apply to the part in swap but only to the part in physical memory?

Answer 1

Address space isolation does apply to privileged processes, but in some cases the data stored in memory can end up being accessible in roundabout ways to sufficiently-privileged processes.

Once data is in swap, any sufficiently privileged process (i.e. one running with sufficient privileges to read the underlying file or device) can read the swap storage directly, and access the data there. The address space isolation is defeated here because the data is accessible in another way than through the memory subsystem.

Note that on older kernels, or kernels configured with /dev/kmem, processes which have sufficient privileges to read that can read any process’ data in memory, also defeating the address space isolation, this time by reading physical memory without going through the virtual memory layer.