linux-kernel - Re: [RFD] clear virtual machine memory when virtual machine is turned off

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 2 Dec 2021 13:47:49 +0100
From:   David Hildenbrand <david@...hat.com>
To:     fei luo <morphyluo@...il.com>, akpm@...ux-foundation.org,
        mike.kravetz@...cle.com, arnd@...db.de,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        linux-arch@...r.kernel.org
Subject: Re: [RFD] clear virtual machine memory when virtual machine is turned
 off

On 02.12.21 11:19, fei luo wrote:
> Hi,
> 
> When running the kvm virtual machine in Linux, because the virtual
> 
> machine may contain sensitive data, the user may not want these
> 
> data to remain in the memory after the virtual machine is turned off.
> 

Hi,

yes, just like if the VM is running.

> 
> Although this part of memory will be cleared before being reused by
> 
> user-mode programs , But the sensitive data staying in the memory
> 
> for a long time will undoubtedly increase the risk of information leakage,
> 
> so I wonder whether it is possible to add a flag (like MAP_UNMAPZERO)
> 
> to the mmap(2) system call to indicate that the mapped memory needs
> 
> to be cleared zero when unmap called or when the program exits.
> 

it's not immediately clear to me why data of user space program #1
should be more important than data of user space program #2 and why the
program should make that decision.

> 
> Of course, the page clear operation not only occurs when unmap called
> 
> or program exits, but also need to consider scenes such as page migration,
> 
> swap, balloon etc.

What about page migration (who clears the old memory location?),
swapping (who clears the swap space, also considering zram?), writeback
(who clears file storage)? Also, as you indicate, MADV_DONTNEED,
MADV_FREE, FALLOC_FL_PUNCH_HOLE would need care ...

To disable swapping you can use mlock(). To handle file storage ...
don't use files. You'd still have to handle any cases where physical
memory locations might be freed and land in the buddy, and for that we
do have ...

> 
> 
> When reusing the page that has been cleared, there is no need to clear it
> 
> again, which also speeds up the memory allocation of user-mode programs.
> 
> 
> Is this feature feasible?

"init_on_free=1" for the system as a whole, which might sounds like what
might tackle part of your use case.

-- 
Thanks,

David / dhildenb