Re: Are memory safety and maximized data volatility mutually exclusive?

On Thu, Oct 8, 2015 at 1:23 AM, rmeijer <rmeijer-qWit8jRvyhVmR6Xm/[email protected]> wrote:

> Working on software that handles sparse capabilities, I keep running into
> the issue that the desire to write maximally robust code and the desire to
> maximize the volatility of sensitive data seem to be mutually exclusive to
> the extreme. In C or C++ I don't have memory safety, yet the lack of memory
> safety gives me the power to overwrite sensitive data at the moment that
> the sensitive data is no longer functionally required. That means if I make
> a memory dump of the process a fraction of a second later, there is no
> trace of the sparse caps left.


Rust is really nice in these sorts of situations.

Rust *is* memory safe, but Rust has an unsafe { ... } keyword to
selectively allow unsafe behavior (explicitly labelled as such), and
supports an unsafe operation for this purpose:
std::intrinsics::volatile_set_memory

This allows the rest of the code to be memory safe, but also to in a very
limited case invoke an unsafe operation when memory.

-- 
Tony Arcieri

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk