3 ms·
Why can’t the kernel just generate a random secret at boot and encrypt swap and hibernate files automatically? MacOS does this. I thought Linux did already. Wit
by api 5y ago
Why can’t the kernel just generate a random secret at boot and encrypt swap and hibernate files automatically? MacOS does this. I thought Linux did already. With AES in hardware it’s not much more costly than memcpy.
- jchw 5y agoThis is done for Linux Lockdown. For memfd_secret, it might not be considered good enough; I think the memory needs to be evicted.
- api 5y agoWhat is the threat model for this? If it’s a highly advanced attacker with physical access not even that is good enough. The best we can do is a true hardware enclave.