4 ms·
It tells the OS to never swap memory allocated to the process to disk. You should always lock memory if you're going to be storing crypto keys, etc. since once
by SteveNuts 8y ago
It tells the OS to never swap memory allocated to the process to disk.
You should always lock memory if you're going to be storing crypto keys, etc. since once the pages are swapped to disk you're vulnerable to someone pulling the swap partition out and reading it.
- rkeene2 8y agoIt is significant to note that: 1. You don't have to lock all your memory (although it may be hard to capture all the intermediate buffers if you don't). 2. You still need to clear the memory buffers after they're no longer going to be used, otherwise other processes can read /proc/kcore, etc (or cool your RAM and extract it and put it another system) 3. It is possible to encrypt the swap partition with a randomly generated key at boot