Re: mutt/580: mutt stores PGP passphrase insecurely
On Fri, Sep 22, 2006 at 11:45:58PM +0100, Paul Walker wrote:
> On Fri, Sep 22, 2006 at 03:24:05PM +0200, Moritz Barsnick wrote:
>
> > mlock()/munlock(). My manpage (old Linux 2.4.20 system) has the return
> > values ENOMEM, EPERM, EINVAL.
>
> Actually - does it really matter why it failed, in that particular case? It
> failed - EINVAL won't be true (since it's global data), ENOMEM likewise,
> which leaves EPERM. 2.4.x, from what I can gather, only does mlock for root
> users.
>
> Therefore, as long as we can detect failure (so we don't try to unlock
> unlocked memory) that's all that really matters.
Yes. The worst thing that could happen is that mutt couldn't get the
lock, and in that case we're no worse off then we are now.
David