You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+8-4Lines changed: 8 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,14 +5,15 @@
5
5
6
6
Securely clear secrets from memory. Built on stable Rust primitives which guarantee memory is zeroed using an operation will not be 'optimized away' by the compiler.
7
7
8
-
It uses [zeroize](https://crates.io/crates/zeroize) crate under the hood to zeroize and [libsodium-sys](https://crates.io/crates/libsodium-sys) for `mlock()` and `munlock()`. **Maximum you can mlock is 4MB**.
8
+
It uses [zeroize](https://crates.io/crates/zeroize) crate under the hood to zeroize and [memsec](https://crates.io/crates/memsec) for `mlock()` and `munlock()`. **Maximum you can mlock is 4MB**.
9
9
It can work with `bytearray` and `numpy array`.
10
10
11
11
> [!WARNING]
12
12
> **In the case of [Copy-on-write fork](https://en.wikipedia.org/wiki/Copy-on-write) you need to zeroize the memory before forking the child process, see example below.
13
13
> Also by itself it doesn't work if memory is moved or moved to swap. You can use `zeroize.mlock()` to lock the memory, see example below.**
14
14
15
15
# Caveats of `mlock()`
16
+
16
17
`mlock` works on pages, so 2 variables could reside in the same page and if you `munlock` one it will `munlock` the whole page and also the memory for the other variable. Ideally you could `munlock` all your vars at same time so it would not be affected by the overlap. One strategy could be to expire your vars that store credentials when not used and to reload them again when needed. Like that you could `mlock` when you load them and `munlock` on expire and keep all vars under the same expire policy. Like this all var will be `munlock`ed at the same time.
17
18
18
19
# Examples
@@ -65,9 +66,8 @@ if __name__ == "__main__":
65
66
## Zeroing memory before forking child process
66
67
67
68
This mitigates the problems that appears on [Copy-on-write fork](https://en.wikipedia.org/wiki/Copy-on-write). You need to zeroize the data before forking the child process.
68
-
```python
69
-
""" In the case of [Copy-on-write fork](https://en.wikipedia.org/wiki/Copy-on-write) you need to zeroize the memory before forking the child process. """
70
69
70
+
```python
71
71
import os
72
72
from zeroize import zeroize1, mlock, munlock
73
73
@@ -109,6 +109,7 @@ if __name__ == "__main__":
109
109
[](https://github.com/codespaces/new/?repo=radumarias%2Fzeroize-python&ref=main)
110
110
111
111
## Geting sources from GitHub
112
+
112
113
Skip this if you're starting it in browser.
113
114
114
115
```bash
@@ -120,13 +121,16 @@ git clone https://github.com/radumarias/zeroize-python && cd zeroize-python
120
121
```bash
121
122
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
122
123
```
124
+
123
125
To configure your current shell, you need to source
124
126
the corresponding env file under $HOME/.cargo.
125
127
This is usually done by running one of the following (note the leading DOT):
0 commit comments