[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAHD6eXdD9zJd8Y2B8CjxSr6+c0TGU45fyv_Civ-34GMwfEhMZg@mail.gmail.com>
Date: Mon, 4 Nov 2024 13:36:08 -0800
From: David Goldblatt <davidtgoldblatt@...il.com>
To: libc-coord@...ts.openwall.com
Cc: Keith Packard <keithp@...thp.com>
Subject: Re: Anyone have a secure 'free' API?
jemalloc has some features that rhyme with this -- with "zero:true" in the
malloc configuration envvar, it will zero out memory before returning it
from an allocation, and with "junk:true" or "junk:free" present it will
fill it with a known junk value immediately on deallocation.
On Mon, Nov 4, 2024 at 12:42 PM Alan Coopersmith <
alan.coopersmith@...cle.com> wrote:
> On 11/4/24 11:46, Keith Packard wrote:
> >
> > I'm wondering if anyone has an API which does memset followed by free to
> > clear sensitive data from the heap after use as compilers will simply
> > drop a call to memset before free these days.
>
> OpenBSD has freezero(), which doesn't rely on details of the malloc
> implementation, but relies on the caller to specify the size to overwrite:
> https://man.openbsd.org/freezero
>
> It's available in libbsd for Linux platforms as well:
> https://man.archlinux.org/man/extra/libbsd/freezero.3bsd.en
>
> We implemented it in Solaris and added a freezeroall() variant that
> relied on our malloc() implementations having a malloc_usable_size()
> call that could be used to query the size:
> https://docs.oracle.com/cd/E88353_01/html/E37843/freezero-3c.html
> https://www.openwall.com/lists/libc-coord/2021/09/17/11
>
> > Linux has kfree_sensitive
> > and memzero_explicit APIs, I'm wondering if anyone on this list has a C
> > library exposing something like this for applications?
>
> memset_explicit() has been standardized in C23:
> https://en.cppreference.com/w/c/string/byte/memset
>
> There's also a number of libc's with the pre-standard explicit_memset()
> or explicit_bzero() as well:
>
>
> https://www.gnu.org/software/libc/manual/html_node/Erasing-Sensitive-Data.html
>
> https://www.gnu.org/software/gnulib/manual/html_node/explicit_005fbzero.html
> https://man.freebsd.org/cgi/man.cgi?query=explicit_bzero&sektion=3
> https://man.netbsd.org/NetBSD-8.0/explicit_memset.3
> https://man.openbsd.org/explicit_bzero.3
>
> (C11 also had memset_s() in the optional AnnexK, but that's not widely
> implemented.)
>
> --
> -Alan Coopersmith- alan.coopersmith@...cle.com
> Oracle Solaris Engineering - https://blogs.oracle.com/solaris
>
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
