fopen mode for buffer clearing

fopen mode for buffer clearing

[Florian Weimer]

We used to use mmap for the internal FILE * buffer.  This had the side 
effect that after fclose, the data in the buffer may not be gone from 
the system as a whole, but it will definitely not be part of the address 
space of the process anymore.  This is desirable if the stdio stream 
functions are used to process sensitive data because it reduces the risk 
of leaks.

Would it make sense to add an fopen mode flag to indicate that the 
implementation should clear the buffer (with explicit_bzero) before 
deallocating it?  This would also apply to reallocating buffers in getline.

Thanks,
Florian

Re: fopen mode for buffer clearing

[Adhemerval Zanella]

On 13/04/2017 06:41, Florian Weimer wrote:
> We used to use mmap for the internal FILE * buffer.  This had the side effect that after fclose, the data in the buffer may not be gone from the system as a whole, but it will definitely not be part of the address space of the process anymore.  This is desirable if the stdio stream functions are used to process sensitive data because it reduces the risk of leaks.
> 
> Would it make sense to add an fopen mode flag to indicate that the implementation should clear the buffer (with explicit_bzero) before deallocating it?  This would also apply to reallocating buffers in getline.
> 
> Thanks,
> Florian

I really dislike exposing implementation details in an API sense, it adds
compatibility issues for other libcs and in the case we want to change the 
internal implementation (since we not have an additional constraint).

Also, for security sensitive operation it would make sense to define an
specific buffer with setvbuf and then the application can control how to
deallocate the buffer.