Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK

From	Colm MacCárthaigh <colm@allcosts.net>
Newsgroups	linux.kernel
Subject	Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK
Date	2017-08-10 15:30 +0200
Message-ID	<ucVHc-65t-13@gated-at.bofh.it> (permalink)
References	<ubupJ-3f0-29@gated-at.bofh.it> <ubQgx-ju-1@gated-at.bofh.it> <ubQzU-s0-19@gated-at.bofh.it> <ubRPk-1xo-13@gated-at.bofh.it> <ucVnP-5Z0-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Thu, Aug 10, 2017 at 3:05 PM, Michal Hocko <mhocko@kernel.org> wrote:
>> Too late for that. VM_DONTFORK is already implemented
>> through MADV_DONTFORK & MADV_DOFORK, in a way that is
>> very similar to the MADV_WIPEONFORK from these patches.
>
> Yeah, those two seem to be breaking the "madvise as an advise" semantic as
> well but that doesn't mean we should follow that pattern any further.

I would imagine that many of the crypto applications using
MADV_WIPEONFORK will also be using MADV_DONTDUMP. In cases where it's
for protecting secret keys, I'd like to use both in my code, for
example. Though that doesn't really help decide this.

There is also at least one case for being able to turn WIPEONFORK
on/off with an existing page; a process that uses privilege separation
often goes through the following flow:

1. [ Access privileged keys as a power user and initialize memory ]
2. [ Fork a child process that actually does the work ]
3. [ Child drops privileges and uses the memory to do work ]
4. [ Parent hangs around to re-spawn a child if it crashes ]

In that mode it would be convenient to be able to mark the memory as
WIPEONFORK in the child, but not the parent.

-- 
Colm

Thread

[PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK riel@redhat.com - 2017-08-06 16:10 +0200
  Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Michal Hocko <mhocko@kernel.org> - 2017-08-07 15:30 +0200
    Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Michal Hocko <mhocko@kernel.org> - 2017-08-07 15:50 +0200
      Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Florian Weimer <fweimer@redhat.com> - 2017-08-07 16:20 +0200
        Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Michal Hocko <mhocko@kernel.org> - 2017-08-10 15:10 +0200
      Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Rik van Riel <riel@redhat.com> - 2017-08-07 17:10 +0200
        Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK "Kirill A. Shutemov" <kirill@shutemov.name> - 2017-08-09 12:10 +0200
          Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Rik van Riel <riel@redhat.com> - 2017-08-09 14:40 +0200
          Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Florian Weimer <fweimer@redhat.com> - 2017-08-09 14:50 +0200
        Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Michal Hocko <mhocko@kernel.org> - 2017-08-10 15:10 +0200
          Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Colm MacCárthaigh <colm@allcosts.net> - 2017-08-10 15:30 +0200
            Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Michal Hocko <mhocko@kernel.org> - 2017-08-10 17:40 +0200
              Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Michal Hocko <mhocko@kernel.org> - 2017-08-10 19:10 +0200
                Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Colm MacCárthaigh <colm@allcosts.net> - 2017-08-11 00:20 +0200
                Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Michal Hocko <mhocko@kernel.org> - 2017-08-11 16:10 +0200
                Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Florian Weimer <fweimer@redhat.com> - 2017-08-11 16:20 +0200
                Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Michal Hocko <mhocko@kernel.org> - 2017-08-11 16:30 +0200
                Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Florian Weimer <fweimer@redhat.com> - 2017-08-11 17:30 +0200
                Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Michal Hocko <mhocko@kernel.org> - 2017-08-11 17:40 +0200
      Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Colm MacCárthaigh <colm@allcosts.net> - 2017-08-07 18:10 +0200
      Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Michal Hocko <mhocko@kernel.org> - 2017-08-10 15:30 +0200
        Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Michal Hocko <mhocko@kernel.org> - 2017-08-10 16:20 +0200
  Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Mike Kravetz <mike.kravetz@oracle.com> - 2017-08-07 20:30 +0200
    Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Florian Weimer <fweimer@redhat.com> - 2017-08-08 12:00 +0200
      Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Rik van Riel <riel@redhat.com> - 2017-08-08 15:20 +0200
        Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Mike Kravetz <mike.kravetz@oracle.com> - 2017-08-08 17:30 +0200
          Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Florian Weimer <fweimer@redhat.com> - 2017-08-08 17:30 +0200
          Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Rik van Riel <riel@redhat.com> - 2017-08-08 17:50 +0200
            Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Colm MacCárthaigh <colm@allcosts.net> - 2017-08-08 18:50 +0200
            Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Matthew Wilcox <willy@infradead.org> - 2017-08-08 19:00 +0200
              Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Rik van Riel <riel@redhat.com> - 2017-08-08 20:50 +0200
                Re: [PATCH v2 0/2] mm,fork,security: introduce MADV_WIPEONFORK Michal Hocko <mhocko@kernel.org> - 2017-08-10 17:40 +0200

csiph-web