On 02/08/2014 12:52 AM, Saiga wrote: > Does DM-Crypt/LUKS purge the RAM of the master key when the shutdown > signal is given? If not how could I configure it to do so? Not explicitly (no shutdown handler directly in dmcrypt) but init system should dismout storage stack properly. (Dmcrypt will wipe key on mapping removal. You can also force removal of active device by "dmsetup remove -f <dev>" - this will replace active dmcrypt mapping by remapping to error target thus removal of key in memory as well.) I think the only init system currently implementing this is systemd, others just only remount read-only on shutdown which will not remove dmcrypt key from memory. You need some ramdisk to do this properly... The problem is obvious here - you have no idea which IO are in flight, so force removal of key is equivalent to force device removal. Another option is to explicitly call key wipe (which will put dmcrypt device in suspend state). Not sure if anyone using this - but it was designed for suspend to RAM. Milan _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
