2

I want to create a secret provisioning systems that on deployment decrypts secrets on the target machine and put them in RAM. They should be accessible as file so that services on the same machine can open them

On Linux there is a file-system called ramfs that will never be swapped out to disk. On macOS there seems to be only a ramdisk. Does this ramdisk get swapped to the disk by the operating system (which would put the secret data on disk)?

Improve this question
5
  • What command to you use to make a ramdisk?
    – bmike ♦
    Jul 25, 2020 at 21:02
  • Please explain your usage pattern of a RAM disk. How you plan to use it how large will it be and why would you want to copy it to disk? Frankly, we just don't see them being used as much these days. They were useful for the extreme speeds and disposable data. Or as a cache scratch space where the data wasn't important. Today's SSD / PCIe NVMe drives are so fast, it makes little sense to run a RAM disk.
    – James Brickley
    Jul 26, 2020 at 2:54
  • It would be possible to script a solution to backup the data from a RAM disk.
    – James Brickley
    Jul 26, 2020 at 2:56
  • 1
    @James Brickley, The OP wants to know if the OS swaps data stored on a RAM disk to the HDD/SSD because he doesn't want that to happen. I probably did to heavy of an edit on the original question.
    – user3439894
    Jul 26, 2020 at 4:48
  • Thanks for the edit, makes a lot more sense now. Interesting idea.
    – James Brickley
    Jul 27, 2020 at 11:40

2 Answers 2

Reset to default
2

Since macOS High Sierra 10.13.x the virtual memory "swapfile(s)" have been encrypted even if FileVault2 disk encryption is off. Obviously, I would test that theory and review any CVE reports and validate it.

https://support.apple.com/guide/mac-help/what-is-secure-virtual-memory-on-mac-mh11852/mac

You might be scratching your left ear with your right hand roundabout the hard way. Consider creating an additional keychain and using that instead. It's far more secure and this is precisely what keychains are designed to accomplish. They secure secrets.

Developer API Docs: https://developer.apple.com/documentation/security

Command line (scripting): man security

Improve this answer
1

Yes, RAM disks created by hdiutil are in ordinary, swappable memory. You might find another way to lock the memory, but Apple's tools do not support creating a RAM disk with wired memory. I found some documentation saying hdiutil might support it in a roundabout way, but I tested it and found that in Catalina 10.5.6 the kernel will not allow it.

If you are worried about a secret in memory being written out to disk via swap, you are going to have to find another way.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .