Re: [PATCH] libuuid: use explicit_bzero() in uuid_clear() when possible

From: Christoph Hellwig <hch@infradead.org>
To: kerolasa@gmail.com
Cc: Christoph Hellwig <hch@infradead.org>,
	util-linux <util-linux@vger.kernel.org>
Subject: Re: [PATCH] libuuid: use explicit_bzero() in uuid_clear() when possible
Date: Tue, 24 Oct 2017 02:30:45 -0700	[thread overview]
Message-ID: <20171024093045.GA5752@infradead.org> (raw)
In-Reply-To: <CAG27Bk0aKyD_ZuTOUTM4jgvaioWGLA2-jUHeZTABO+0hz354gw@mail.gmail.com>

On Mon, Oct 23, 2017 at 08:38:20PM +0100, Sami Kerola wrote:
> > Can you explain the logic behind this a bit more?  If no one uses the
> > uuid later it doesn't matter if we cleared it or not.
> 
> When value is not used compiler might deside to remove such clearning
> altogether. To me uuid_clear() is promise that the value disappears, and
> that is what the function should do. Who knows, maybe someone uses
> uuids to something sensitive that must be cleared not to leak secrets.
> In that sort of context one really hopes promise of clearing is kept.

That's not how uuid_clear is documented.  From the man page:

NAME
       uuid_clear - reset value of UUID variable to the NULL value

SYNOPSIS
       #include <uuid.h>

       void uuid_clear(uuid_t uu);

DESCRIPTION
       The uuid_clear function sets the value of the supplied uuid variable uu to the NULL value.

If the variable isn't used it obviously must not be cleared.