[dm-crypt] RAM Flush on Shutdown?

Milan Broz gmazyland at gmail.com
Sat Feb 8 18:05:05 CET 2014


On 02/08/2014 12:52 AM, Saiga wrote:
> Does DM-Crypt/LUKS purge the RAM of the master key when the shutdown
> signal is given? If not how could I configure it to do so?

Not explicitly (no shutdown handler directly in dmcrypt) but init
system should dismout storage stack properly.
(Dmcrypt will wipe key on mapping removal. You can also force removal
of active device by "dmsetup remove -f <dev>" - this will replace active
dmcrypt mapping by remapping to error target thus removal of key
in memory as well.)

I think the only init system currently implementing this is systemd,
others just only remount read-only on shutdown which will not remove
dmcrypt key from memory. You need some ramdisk to do this properly...

The problem is obvious here - you have no idea which IO are in flight,
so force removal of key is equivalent to force device removal.

Another option is to explicitly call key wipe (which will put dmcrypt
device in suspend state). Not sure if anyone using this - but it was
designed for suspend to RAM.

Milan


More information about the dm-crypt mailing list