260 lines
6.2 KiB
HTML
260 lines
6.2 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of BZERO</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>BZERO</H1>
|
|
Section: Linux Programmer's Manual (3)<BR>Updated: 2019-03-06<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
bzero, explicit_bzero - zero a byte string
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<PRE>
|
|
<B>#include <<A HREF="file:///usr/include/strings.h">strings.h</A>></B>
|
|
|
|
<B>void bzero(void *</B><I>s</I><B>, size_t </B><I>n</I><B>);</B>
|
|
|
|
<B>#include <<A HREF="file:///usr/include/string.h">string.h</A>></B>
|
|
|
|
<B>void explicit_bzero(void *</B><I>s</I><B>, size_t </B><I>n</I><B>);</B>
|
|
</PRE>
|
|
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
The
|
|
<B>bzero</B>()
|
|
|
|
function erases the data in the
|
|
<I>n</I>
|
|
|
|
bytes of the memory starting at the location pointed to by
|
|
<I>s</I>,
|
|
|
|
by writing zeros (bytes containing '\0') to that area.
|
|
<P>
|
|
|
|
The
|
|
<B>explicit_bzero</B>()
|
|
|
|
function performs the same task as
|
|
<B>bzero</B>().
|
|
|
|
It differs from
|
|
<B>bzero</B>()
|
|
|
|
in that it guarantees that compiler optimizations will not remove the
|
|
erase operation if the compiler deduces that the operation is "unnecessary".
|
|
<A NAME="lbAE"> </A>
|
|
<H2>RETURN VALUE</H2>
|
|
|
|
None.
|
|
<A NAME="lbAF"> </A>
|
|
<H2>VERSIONS</H2>
|
|
|
|
<B>explicit_bzero</B>()
|
|
|
|
first appeared in glibc 2.25.
|
|
<A NAME="lbAG"> </A>
|
|
<H2>ATTRIBUTES</H2>
|
|
|
|
For an explanation of the terms used in this section, see
|
|
<B><A HREF="/cgi-bin/man/man2html?7+attributes">attributes</A></B>(7).
|
|
|
|
<TABLE BORDER>
|
|
<TR VALIGN=top><TD><B>Interface</B></TD><TD><B>Attribute</B></TD><TD><B>Value</B><BR></TD></TR>
|
|
<TR VALIGN=top><TD>
|
|
<B>bzero</B>(),
|
|
|
|
<BR>
|
|
|
|
<B>explicit_bzero</B>()
|
|
|
|
</TD><TD>Thread safety</TD><TD>MT-Safe<BR></TD></TR>
|
|
</TABLE>
|
|
|
|
<A NAME="lbAH"> </A>
|
|
<H2>CONFORMING TO</H2>
|
|
|
|
The
|
|
<B>bzero</B>()
|
|
|
|
function is deprecated (marked as LEGACY in POSIX.1-2001); use
|
|
<B><A HREF="/cgi-bin/man/man2html?3+memset">memset</A></B>(3)
|
|
|
|
in new programs.
|
|
POSIX.1-2008 removes the specification of
|
|
<B>bzero</B>().
|
|
|
|
The
|
|
<B>bzero</B>()
|
|
|
|
function first appeared in 4.3BSD.
|
|
<P>
|
|
|
|
The
|
|
<B>explicit_bzero</B>()
|
|
|
|
function is a nonstandard extension that is also present on some of the BSDs.
|
|
Some other implementations have a similar function, such as
|
|
<B>memset_explicit</B>()
|
|
|
|
or
|
|
<B>memset_s</B>().
|
|
|
|
<A NAME="lbAI"> </A>
|
|
<H2>NOTES</H2>
|
|
|
|
The
|
|
<B>explicit_bzero</B>()
|
|
|
|
function addresses a problem that security-conscious applications
|
|
may run into when using
|
|
<B>bzero</B>():
|
|
|
|
if the compiler can deduce that the location to zeroed will
|
|
never again be touched by a
|
|
<I>correct</I>
|
|
|
|
program, then it may remove the
|
|
<B>bzero</B>()
|
|
|
|
call altogether.
|
|
This is a problem if the intent of the
|
|
<B>bzero</B>()
|
|
|
|
call was to erase sensitive data (e.g., passwords)
|
|
to prevent the possibility that the data was leaked
|
|
by an incorrect or compromised program.
|
|
Calls to
|
|
<B>explicit_bzero</B>()
|
|
|
|
are never optimized away by the compiler.
|
|
<P>
|
|
|
|
The
|
|
<B>explicit_bzero</B>()
|
|
|
|
function does not solve all problems associated with erasing sensitive data:
|
|
<DL COMPACT>
|
|
<DT id="1">1.<DD>
|
|
The
|
|
<B>explicit_bzero</B>()
|
|
|
|
function does
|
|
<I>not</I>
|
|
|
|
guarantee that sensitive data is completely erased from memory.
|
|
(The same is true of
|
|
<B>bzero</B>().)
|
|
|
|
For example, there may be copies of the sensitive data in
|
|
a register and in "scratch" stack areas.
|
|
The
|
|
<B>explicit_bzero</B>()
|
|
|
|
function is not aware of these copies, and can't erase them.
|
|
<DT id="2">2.<DD>
|
|
In some circumstances,
|
|
<B>explicit_bzero</B>()
|
|
|
|
can
|
|
<I>decrease</I>
|
|
|
|
security.
|
|
If the compiler determined that the variable containing the
|
|
sensitive data could be optimized to be stored in a register
|
|
(because it is small enough to fit in a register,
|
|
and no operation other than the
|
|
<B>explicit_bzero</B>()
|
|
|
|
call would need to take the address of the variable), then the
|
|
<B>explicit_bzero</B>()
|
|
|
|
call will force the data to be copied from the register
|
|
to a location in RAM that is then immediately erased
|
|
(while the copy in the register remains unaffected).
|
|
The problem here is that data in RAM is more likely to be exposed
|
|
by a bug than data in a register, and thus the
|
|
<B>explicit_bzero</B>()
|
|
|
|
call creates a brief time window where the sensitive data is more
|
|
vulnerable than it would otherwise have been
|
|
if no attempt had been made to erase the data.
|
|
</DL>
|
|
<P>
|
|
|
|
Note that declaring the sensitive variable with the
|
|
<B>volatile</B>
|
|
|
|
qualifier does
|
|
<I>not</I>
|
|
|
|
eliminate the above problems.
|
|
Indeed, it will make them worse, since, for example,
|
|
it may force a variable that would otherwise have been optimized
|
|
into a register to instead be maintained in (more vulnerable)
|
|
RAM for its entire lifetime.
|
|
<P>
|
|
|
|
Notwithstanding the above details, for security-conscious applications, using
|
|
<B>explicit_bzero</B>()
|
|
|
|
is generally preferable to not using it.
|
|
The developers of
|
|
<B>explicit_bzero</B>()
|
|
|
|
anticipate that future compilers will recognize calls to
|
|
<B>explicit_bzero</B>()
|
|
|
|
and take steps to ensure that all copies of the sensitive data are erased,
|
|
including copies in registers or in "scratch" stack areas.
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+bstring">bstring</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+memset">memset</A></B>(3),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?3+swab">swab</A></B>(3)
|
|
|
|
<A NAME="lbAK"> </A>
|
|
<H2>COLOPHON</H2>
|
|
|
|
This page is part of release 5.05 of the Linux
|
|
<I>man-pages</I>
|
|
|
|
project.
|
|
A description of the project,
|
|
information about reporting bugs,
|
|
and the latest version of this page,
|
|
can be found at
|
|
<A HREF="https://www.kernel.org/doc/man-pages/.">https://www.kernel.org/doc/man-pages/.</A>
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="3"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="4"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="5"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="6"><A HREF="#lbAE">RETURN VALUE</A><DD>
|
|
<DT id="7"><A HREF="#lbAF">VERSIONS</A><DD>
|
|
<DT id="8"><A HREF="#lbAG">ATTRIBUTES</A><DD>
|
|
<DT id="9"><A HREF="#lbAH">CONFORMING TO</A><DD>
|
|
<DT id="10"><A HREF="#lbAI">NOTES</A><DD>
|
|
<DT id="11"><A HREF="#lbAJ">SEE ALSO</A><DD>
|
|
<DT id="12"><A HREF="#lbAK">COLOPHON</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:05:37 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|