Skip to content

Commit 13dc8eb

Browse files
committed
fscrypt: mention init_on_free instead of page poisoning
Page poisoning is an older debug option. The modern way to initialize memory on free for security reasons is to set init_on_free=1. Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Eric Biggers <[email protected]>
1 parent eea957d commit 13dc8eb

File tree

1 file changed

+2
-3
lines changed

1 file changed

+2
-3
lines changed

Documentation/filesystems/fscrypt.rst

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -137,9 +137,8 @@ However, these ioctls have some limitations:
137137
- In general, decrypted contents and filenames in the kernel VFS
138138
caches are freed but not wiped. Therefore, portions thereof may be
139139
recoverable from freed memory, even after the corresponding key(s)
140-
were wiped. To partially solve this, you can set
141-
CONFIG_PAGE_POISONING=y in your kernel config and add page_poison=1
142-
to your kernel command line. However, this has a performance cost.
140+
were wiped. To partially solve this, you can add init_on_free=1 to
141+
your kernel command line. However, this has a performance cost.
143142

144143
- Secret keys might still exist in CPU registers, in crypto
145144
accelerator hardware (if used by the crypto API to implement any of

0 commit comments

Comments
 (0)