[dm-crypt] RAM Flush on Shutdown?

[dm-crypt] RAM Flush on Shutdown?

[Saiga]

Does DM-Crypt/LUKS purge the RAM of the master key when the shutdown
signal is given? If not how could I configure it to do so?

Re: [dm-crypt] RAM Flush on Shutdown?

[Milan Broz]

On 02/08/2014 12:52 AM, Saiga wrote:
> Does DM-Crypt/LUKS purge the RAM of the master key when the shutdown
> signal is given? If not how could I configure it to do so?

Not explicitly (no shutdown handler directly in dmcrypt) but init
system should dismout storage stack properly.
(Dmcrypt will wipe key on mapping removal. You can also force removal
of active device by "dmsetup remove -f <dev>" - this will replace active
dmcrypt mapping by remapping to error target thus removal of key
in memory as well.)

I think the only init system currently implementing this is systemd,
others just only remount read-only on shutdown which will not remove
dmcrypt key from memory. You need some ramdisk to do this properly...

The problem is obvious here - you have no idea which IO are in flight,
so force removal of key is equivalent to force device removal.

Another option is to explicitly call key wipe (which will put dmcrypt
device in suspend state). Not sure if anyone using this - but it was
designed for suspend to RAM.

Milan