5 ms·
I like /tmp in RAM myself, it's truly temporary that way EDIT: I do this more for avoiding certain disk reads/writes than security actually
by Aardwolf 2y ago
I like /tmp in RAM myself, it's truly temporary that way
EDIT: I do this more for avoiding certain disk reads/writes than security actually
- nullindividual 2y agoYou'd need to pin pages in physical memory to guarantee it stays in physical memory. What happens if an 'attacker' (or accidental user) exceeds available physical memory? OOM Kill other applications? Just don't accept temp data, leading to failures in operations requested by the user or system? Pages in physical memory are not typically zero'ed out upon disuse. Yes, they're temporary... but only guaranteed temporary if you turn the system off and the DRAM cells bleed out their voltage.
- Aardwolf 2y agoI use this with a size of a few GB: https://wiki.archlinux.org/title/Tmpfs https://wiki.archlinux.org/title/Tmpfs
- noirscape 2y agoBy default a tmpfs has a really low RAM priority so the OS will try to move it in swapspace if memory gets low. tmpfs size is specified on creation of the tmpfs (and cant be larger than the total memory available, which is swap + RAM) but it's only "occupied" when files begin to fill the tmpfs. If it gets too full for regular OS operations, you get the fun of the OOM Killer shutting down services (tmpfs is never targeted by the OOM Killer) until the entire OS just deadlocks if you somehow manage to fill the tmpfs up entirely.
- nullindividual 2y ago> OS will try to move it in swapspace if memory gets low That defeats the idea GP presented.
- noirscape 2y agoThat depends on how you view swapspace; on most devices, swapspace is either created as a separate partition on the disk or as a file living somewhere on the filesystem. For practical reasons, swapspace isn't really the same thing as keeping it in an actual storage folder - the OS treats swapspace as essentially being empty data on each reboot. (You'd probably be able to extract data from swapspace with disk recovery tools though.) On a literal level it's not the same as "keep it in RAM", but practically speaking swapspace is treated as a seamless (but slower) extension of installed RAM.
- nullindividual 2y ago> On a literal level it's not the same as "keep it in RAM" I read the GP as 'literal level' in-RAM. If I interpreted that incorrectly, apologies to GP.
- marcosdumay 2y agoIt may or may not be what the OP was talking about, depending on your threat model.
- dspillett 2y agoOnly if memory gets low, otherwise it'll stay in RAM and give the benefit GGP intended. IIRC tmpfs data shouldn't be evicted to swap just to allow more room for cache, or if an app requests a large chunk of memory but doesn't use it, just to allow more room for application pages that are actively in use. Normal case: tmpfs data stays in RAM Worst case: it is pushed to swap partitions/files, which is no worse than it being in a filesystem on physical media to start with (depending on access patters and how swap space is arranged it may still be a little more efficient). It isn't quite the same as /tmp being on disk anyway but under normal loads in cache, because the data will usually get written to disk even if only ever read from cache and the cached data from disk will be evicted to make room for caching other data where tmpfs data is less likely to.
- 2y ago
- RiverCrochet 2y agoWell I guess you could tell Linux to not use some memory addresses using the BadRAM feature, then setup an `mtd` device to those memory addresses and create a RAM-based block device, then use `cryptsetup` to encrypt it. If your Linux box is headless and you have a GPU with RAM there mostly sitting unused then you could use the VRAM.
- akira2501 2y ago> exceeds available physical memory? shm and memory mounts use half the available system memory by default. so this is not typically possible. > are not typically zero'ed out upon disuse They're zeroed when they're reallocated. > and the DRAM cells bleed out their voltage. This occurs in less than a second in almost every room temperature environment.
- pama 2y agoThe /tmp in RAM does not address any of the vulnerabilities unfortunately.
- noirscape 2y agoIt's also the default on most distros these days since it means /tmp is always wiped on every reboot. (For a programming side, this also means that if you write a file to /tmp, it'll probably have the fastest read/write speed you can find on the OS, which can be desirable.)
- rurban 2y agoI prefer the explicit /dev/shm for this.
- rnd0 2y agoI thought that was the standard in Linux, at least. I'm not sure how they do it in the BSDs.
- tolciho 2y agoThis is fine until something uses more memory than is available, such as sox insisting on routing a huge audio file though a too-small /tmp, or the MATLAB installer likewise only using /tmp. With sox you could in theory recompile to get it to use some other path (iirc none of the TMP or TMPDIR environment variables did anything), but I instead gave up on the /tmp in memory (it complicated the OpenBSD desktop setup). I forget exactly how I worked around the MATLAB installer issue, probably something horrible involving LD_PRELOAD or time wasted reconfiguring and rebooting and reconfiguring and rebooting one node to do the install on, plus more time wasted running the massive and bloated installer process(es) under strace to see exactly what file paths were in play. So, not really a fan of /tmp in memory. (And I don't much run massive and bloated browsers that may murder your SSD lifetime with excessive file writes better diverted to an in-memory /tmp.)
- anyfoo 2y agoIdeally you have swap, so that stuff that's not actually in use ends up in swap instead of occupying physical memory. That's why you still usually see machines with unreasonable amounts of GB of RAM having swap partitions: Instead of having data that's rarely, if ever, used occupy precious DRAM, it's much better to have that data in swap so that the DRAM can contain, say, filesystem caches.
- cryptonector 2y agoOk, but that's not relevant or responsive to TFA.
- anyfoo 2y agoThere is (fortunately) no rule that replies have to be explicit responses to anything in the article. Tangents are welcome in my mind.