[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <0eb49374-adc9-416a-aa89-31832102b6cb@oracle.com>
Date: Mon, 4 Nov 2024 12:41:44 -0800
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: libc-coord@...ts.openwall.com, Keith Packard <keithp@...thp.com>
Subject: Re: Anyone have a secure 'free' API?
On 11/4/24 11:46, Keith Packard wrote:
>
> I'm wondering if anyone has an API which does memset followed by free to
> clear sensitive data from the heap after use as compilers will simply
> drop a call to memset before free these days.
OpenBSD has freezero(), which doesn't rely on details of the malloc
implementation, but relies on the caller to specify the size to overwrite:
https://man.openbsd.org/freezero
It's available in libbsd for Linux platforms as well:
https://man.archlinux.org/man/extra/libbsd/freezero.3bsd.en
We implemented it in Solaris and added a freezeroall() variant that
relied on our malloc() implementations having a malloc_usable_size()
call that could be used to query the size:
https://docs.oracle.com/cd/E88353_01/html/E37843/freezero-3c.html
https://www.openwall.com/lists/libc-coord/2021/09/17/11
> Linux has kfree_sensitive
> and memzero_explicit APIs, I'm wondering if anyone on this list has a C
> library exposing something like this for applications?
memset_explicit() has been standardized in C23:
https://en.cppreference.com/w/c/string/byte/memset
There's also a number of libc's with the pre-standard explicit_memset()
or explicit_bzero() as well:
https://www.gnu.org/software/libc/manual/html_node/Erasing-Sensitive-Data.html
https://www.gnu.org/software/gnulib/manual/html_node/explicit_005fbzero.html
https://man.freebsd.org/cgi/man.cgi?query=explicit_bzero&sektion=3
https://man.netbsd.org/NetBSD-8.0/explicit_memset.3
https://man.openbsd.org/explicit_bzero.3
(C11 also had memset_s() in the optional AnnexK, but that's not widely
implemented.)
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
