From db274ce4878ce75ee79f71804475e2ae02fa1e9d Mon Sep 17 00:00:00 2001 From: Laan Tungir Date: Sun, 19 Jul 2026 14:35:00 -0400 Subject: [PATCH] =?UTF-8?q?v0.0.51=20-=20Document=20memfd=5Fsecret=20as=20?= =?UTF-8?q?future=20secret-memory=20backing=20in=20README=20=C2=A72.5=20(m?= =?UTF-8?q?lock=20remains=20current=20path;=20memfd=5Fsecret=20unusable=20?= =?UTF-8?q?on=20Qubes=20Xen=20guests=20due=20to=20SIGBUS=20on=20page=20mat?= =?UTF-8?q?erialization)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 8 ++++++++ src/main.c | 4 ++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 9e336f3..d2d0d64 100644 --- a/README.md +++ b/README.md @@ -65,6 +65,14 @@ This reduces deployment variability and shrinks the runtime trust surface. `n_signer` is intentionally human-attended. It stays attached to a terminal and can require explicit keystroke approval for unknown callers or sensitive actions. Human presence is part of the security model. +### 2.5 Secret memory backing: `mlock` today, `memfd_secret` where supported + +Sensitive buffers (mnemonic, master seed, per-role private keys) live in `mlock`'d RAM via [`secure_buf_alloc`](src/secure_mem.c) and are zeroized with `secure_memzero` on free. This gives swap protection and crash-wipe semantics on every supported platform, including Qubes OS Xen guests. + +`memfd_secret(2)` (Linux `CONFIG_SECRETMEM`) is a stronger backing: pages are invisible to `/proc/pid/mem`, `ptrace`, `kcore`, and hibernation dumps, and are kernel-guaranteed to be wiped on exit. It is the intended tier-1 upgrade for the `secure_buf_alloc` path on hosts that can materialize secretmem pages — bare metal and KVM guests. + +It is **not** used yet because Qubes OS VMs are Xen guests: the `memfd_secret` syscall succeeds and returns a valid `/secretmem` fd, but the first page-fault into the mapping raises `SIGBUS` (the Xen hypervisor cannot back the restricted pages). Since Qubes integration is a primary deployment target, the `mlock` path remains correct and universal. A future implementation will probe `memfd_secret` by writing a canary byte into a trial mapping and fall back to `mlock` on `SIGBUS`/`ENOSYS`, enabling the stronger backing automatically on non-Xen hosts. + ## 3. How it works ### 3.1 Startup phase (TUI input mode) diff --git a/src/main.c b/src/main.c index 1e78bc3..eda67d4 100644 --- a/src/main.c +++ b/src/main.c @@ -759,8 +759,8 @@ int socket_name_random(char *out, size_t out_len); /* Version information (auto-updated by build/version tooling) */ #define NSIGNER_VERSION_MAJOR 0 #define NSIGNER_VERSION_MINOR 0 -#define NSIGNER_VERSION_PATCH 50 -#define NSIGNER_VERSION "v0.0.50" +#define NSIGNER_VERSION_PATCH 51 +#define NSIGNER_VERSION "v0.0.51" /* NSIGNER_HEADERLESS_DECLS_END */