31 ms·

I believe that unexported shell variables will be visible in /proc/*/mem, so it would be prudent to overwrite then unset them as soon as reasonably possible in

• evgpbfhnr 9mo ago
  mem, yes, definitely. I'm not sure how you can protect yourself from that (or root user using ptrace or equivalent debugging tool) though... Oh, memfd_secret? The memory areas backing the file created with memfd_secret(2) are visible only to the processes that have ac‐ cess to the file descriptor. The memory region is removed from the kernel page tables and only the page tables of the processes holding the file descriptor map the corresponding physical memory. (Thus, the pages in the re‐ gion can't be accessed by the kernel itself, so that, for example, pointers to the region can't be passed to system calls.)
  • CableNinja 9mo ago
    Hm, this is interesting. What kernel version did you find this in? Im curious if this is exposed to other languages
    • sllabres 9mo ago
      From the man page: Linux 5.14. Before Linux 6.5, memfd_secret() was disabled by default and only available if the system administrator turned it on using "secretmem.enable=y" kernel parameter. [...] "To prevent potential data leaks of memory regions backed by memfd_secret() from a hybernation image, hybernation is prevented when there are active memfd_secret() users."