Hi, On Fri, Aug 13, 2021 at 12:21:43AM +0300, Vitaly Chikunov wrote: > After CRYPTO_secure_malloc_init OpenSSL will store private keys in > secure heap. This facility is only available since OpenSSL_1_1_0-pre1 > and enabled for 'ima_sign', 'sign', 'sign_hash', and 'hmac'. > setvbuf(3) _IONBF is used to hopefully avoid private key and password > being stored inside of stdio buffers. I should note that usefulness of this method (of avoiding buffering) is not proven. I don't find other implementations doing it. So, I'm open to suggestion of removing it. Thanks, > > Unfortunately, secure heap is not used for the passwords (`-p') due to > absence of its support in the older OpenSSL where ima-evem-utils still > should work, thus simple cleansing of password memory is used where > possible to shorten its lifespan. > > Signed-off-by: Vitaly Chikunov <vt@xxxxxxxxxxxx> > --- > Perhaps, it will conflict with Bruno's patch, we should decide which > one goes first if this will be accepted. > > src/evmctl.c | 83 ++++++++++++++++++++++++++++++++++++++++++++++--- > src/libimaevm.c | 14 ++++++++- > 2 files changed, 92 insertions(+), 5 deletions(-)
