From: Chad Perrin <perrin@...>
Date: 2010-02-20T04:09:10+09:00
Subject: Re: using secure memory

--4SFOXa2GPu3tIq4H
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Feb 19, 2010 at 05:29:34PM +0900, Aaron Patterson wrote:
> On Fri, Feb 19, 2010 at 04:41:16PM +0900, Chad Perrin wrote:
> > I'm writing a utility that needs to use secure memory (that is, won't
> > swap to disk).  Is there a "best practices" way to do this with Ruby,
> > some common library that could be used for this purpose, et cetera?
>=20
> What do you need to do exactly?  Are you going to be allocating the
> memory yourself?  If so, you might want to look for wrappers around
> mlock, and use the mmap gem.
>=20
> If you're talking about the entire ruby VM, I would suggest compiling
> your own Ruby, but modifying the memory allocators to use something like
> secmalloc:

I'm basically just looking to ensure that any data a small program
handles will not get written to disk.  This is not intended to be
something only I (and specially prepared users) can employ, but rather a
program that can be used with a standard Ruby install without dumping
sensitive data to the swap partition if RAM usage gets too high, so
compiling my own Ruby interpreter/VM to behave the way I like isn't
really an appropriate solution.

How exactly I'll handle this in Ruby is dependent on the answer to my
question.  If I have to allocate memory myself, so be it.  If there's
some Ruby library that can abstract away the heavy lifting, so much the
better (though I hadn't found anything like that yet).  At first glance,
it looks like Mmap might do it.  I'll look into that.  Thank you for
mentioning it.

Do you happen to know off-hand if it leaks via the Ruby interpreter/VM at
all?

--=20
Chad Perrin [ original content licensed OWL: http://owl.apotheon.org ]

--4SFOXa2GPu3tIq4H
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (FreeBSD)

iEYEARECAAYFAkt+2WYACgkQ9mn/Pj01uKUTtACghDP+sjuzGItAw23zJYZMe47t
4HEAn0+5pQtA6V1PHzmjGcZgS6GwX8J5
=/IIn
-----END PGP SIGNATURE-----

--4SFOXa2GPu3tIq4H--