Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Linux since 3.4 has MADV_DONTDUMP [1], and there also appears to be a /proc filter file you can use to exclude general segments of memory from being dumped [2].

1. http://man7.org/linux/man-pages/man2/madvise.2.html

2. http://man7.org/linux/man-pages/man5/core.5.html



It's hard to blacklist every piece of memory that might be sensitive. It's a much better idea, IMHO, to just put corefiles in a location accessible only to root. That's how Windows, OS X, Ubuntu, Android, and lots of other commercial systems work.


.. which you need to do anyway. The SSL library, and the program linked against it, can fail in a thousand more ways that generate them.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: