0

From The Linux Programming Interface

The virtual memory page containing the data may be swapped out (unless it is locked in memory using mlock() or similar), and could then be read from the swap area by a privileged program.

I learned that the virtual memory address space of a process is not accessible to another process. The above quote makes me wonder

  • Does that isolation claim does not apply to another privileged process?

  • Does that not apply to the part in swap but only to the part in physical memory?

1 Answer 1

2

Address space isolation does apply to privileged processes, but in some cases the data stored in memory can end up being accessible in roundabout ways to sufficiently-privileged processes.

Once data is in swap, any sufficiently privileged process (i.e. one running with sufficient privileges to read the underlying file or device) can read the swap storage directly, and access the data there. The address space isolation is defeated here because the data is accessible in another way than through the memory subsystem.

Note that on older kernels, or kernels configured with /dev/kmem, processes which have sufficient privileges to read that can read any process’ data in memory, also defeating the address space isolation, this time by reading physical memory without going through the virtual memory layer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .