3

I hope you've all seen the wonderful site, Linux Ate My Ram. This is usually great, but it presents a problem for me. I have a secure file that I'm decrypting with gpg and then reading into memory to process. The unencrypted file is deleted a short time later, but I do NOT want that decrypted file to be saved in Linux's in-memory file cache.

Is there a way to explicitly prevent a file from being saved from Linux's cache?

Thanks!

Improve this question

3 Answers 3

Reset to default
9

Use gpg -d, which will cause GPG to output the file to STDOUT, so then you can have it all in memory.

Depending on how paranoid you are, you may want to use mlock as well.

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

+1 to this answer. If you truly want to be safe you should prevent the page containing your secret text from being swapped to disk by using mlock/mlockall.
Thanks for your answer. I did know about gpg -d but for odd environment reasons I need to write the file out to disk, so this doesn't quite help me solve my problem.
2

If you really, really need gpg's output to be a file, you could put that file on a ramfs file system. The file's contents will only exist in non-swappable memory pages.

You can attach a ramfs file system to your tree by running (as root):

mount none /your/mnt/point -t ramfs

You may have also heard of tmpfs. It's similar in that its files have no permanent storage and generally exist only in RAM. However, for your use, you want to avoid this file system because tmpfs files can be swapped to disk.

Improve this answer

Comments

0

Sure. Shred the file as you delete it.

shred -u $FILE

Granted, it doesn't directly answer your question, but I still think it's a solution---whatever's living in the cache is now randomly-generated garbage. :-)

Improve this answer

6 Comments

I was about to say something about how shred doesn't guarantee proper function on journaled file systems, but since you're only interested in flushing the in-memory cache, maybe it doesn't matter.
Which, as shred(1) will tell you, doesn't necessarily purge the file from disk when used with NFS, a journaling FS, or a RAID array.
@Nathan Kidd: You may be right, but leaving sensitive data on disk rather than in RAM is a much greater security risk.
@larsmans: he specifically asked about the disk cache. Of course in the bigger security picture it was the wrong question. :)
Hi guys, I sort of assumed that the file would be securely deleted as well, so thanks for the heads up on shred.
|

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.