News for hackers. Stuff that matters.

A comment on Environment Variables Considered Harmful for Your Secrets.

Re:Environment Variables Considered Harmful for Your Secrets by phunge on Friday January 02, 2015 @12:21PM (#8827544)
There's a not-widely-publicized feature of Linux that allows programs to store secrets directly in the kernel: https://www.kernel.org/doc/Documentation/security/keys.txt That has some advantages, including the guarantee that it can't be swapped to disk. Kerberos can use it for secret storage, I haven't seen it used elsewhere though.

It looks like process-private storage is one of its features.

[ Parent | on HN ]
Re:Environment Variables Considered Harmful for Your Secrets by jjmason on Friday January 02, 2015 @02:18PM (#8828052)
I haven't looked to hard at the docs yet, but this seems kind of awesome. Is it something that you have to build your own kernel for, or is it configurable in a prebuilt kernel?
[ Parent | on HN ]
Re:Environment Variables Considered Harmful for Your Secrets by jbert on Friday January 02, 2015 @05:02PM (#8828817)
Stock ubuntu here has a /proc/keys file, so I think it's generally available.
[ Parent | on HN ]
Re:Environment Variables Considered Harmful for Your Secrets by olefoo on Friday January 02, 2015 @03:55PM (#8828498)
The main drawback of this ( and it's a minor drawback in the larger scheme of things ) is that this isn't a portable interface and isn't available on other POSIX-ish OS's. It looks like there are key agents available for Freebsd, OS X and Illumos though.

Thanks for pointing this out.

[ Parent | on HN ]
Re:Environment Variables Considered Harmful for Your Secrets by falcolas on Friday January 02, 2015 @03:55PM (#8828493)
It seems like the security for that keyring is based on uid, which can cause problems in the world of containers.

https://news.ycombinator.com/item?id=8321210

[ Parent | on HN ]