Mimi,
On Mon, Sep 13, 2021 at 01:51:58PM -0400, Mimi Zohar wrote:
> > > Assuming we aren't guaranteed that the heap size is allocated, should
> > > we check (e.g. OPENSSL_secure_actual_size())?
> >
> > We guaranteed that secure heap is allocated by return value of
> > CRYPTO_secure_malloc_init.
> >
> > OPENSSL_secure_actual_size tell if OPENSSL_secure_malloc is actually
> > provided bigger memory fragment than we requested (to reduce
> > fragmentation). Why care about it?
>
> We wouldn't care, assuming we're guaranteed the heap size requested was
> allocated and not the minimum heap size. Hm, wondering what would be
> the purpose of the minimum heap size ...
Perhaps, just to control heap fragmentation.
> > > > + if (!CRYPTO_secure_malloc_init(8192, 64))
> > > > + log_err("CRYPTO_secure_malloc_init() failed\n");
> > >
> > > Either change the test to "!= 1" or also log "and 2 if successful but
> > > the heap could not be protected by memory mapping."
> >
> > Why should we care about implementation details of successful
> > allocation? If they don't think it's secure heap they should not return
> > success. And they say about its return value "and 2 if successful but",
> > so it's successful.
>
> If you're correct, then there is no reason ever for returning 2.
> Without documentation or digging into OpenSSL, this makes no sense to
> me. Perhaps "secure heap" has some kernel dependency, requires HW, or
> something else entirely. Not that there is much we could or would do,
> but simply ignoring it just seems wrong.
I looked at CRYPTO_secure_malloc_init and it seems they return 2 if
mlock/madvise is failed. I think it's major enough to report it, so I
will add it.
Thanks,
