Re: [PATCH 3/4] mm/secretmem: zeroize secret pages before kdump
Jan Sebastian Götte <[email protected]>
| Newsgroups | org.kernel.vger.linux-integrity,org.infradead.lists.kexec,org.kernel.vger.keyrings,org.kernel.vger.linux-devicetree,org.kernel.vger.linux-kernel,org.kernel.vger.linux-security-module,org.kvack.linux-mm |
|---|---|
| Message-ID | <[email protected]> |
On 8/11/26 16:53, David Hildenbrand (Arm) wrote: > On 7/31/26 18:27, Jan Sebastian Götte wrote: >> Register a CRASH_ZEROIZE notifier that wipes secretmem folios. As a >> result, when CONFIG_CRASH_ZEROIZE is set, secretmem areas will be >> cleared before the kdump kernel is kexec'ed. > > Are you actually using secretmem in your use case? I heard some rumors that > secretmem isn't used all that much in practice :) I'm aware nobody is really using secretmem. I decided to build this on top of secretmem because it's an existing API that actually kind of fits the use case. While I could have added a new API just for this (marking userspace memory as wipe-on-crash), making it part of secretmem instead gives some additional defense-in-depth protection for both users who only need wiping, and for users who only want secretmem's additional protection against kernel memory read primitives so I think everyone wins here.