mirror of
https://github.com/hanzoai/egress.git
synced 2026-10-30 15:08:38 +00:00
zeekay
5423ac5213
Egress writes no file, refuses core dumps, mounts no writable path and hides /proc — and none of that governs the kernel, which pages anonymous memory to swap whenever it likes. A key held only in RAM is still a key on a disk once it has been swapped, and it stays there after the process is gone. That was the last way a credential reached one. It now calls mlockall(MCL_CURRENT|MCL_FUTURE) BEFORE opening the store, because the credential does not exist yet at that point and locking after a secret is in memory locks it too late. MCL_FUTURE is the half that matters for the same reason. The unit grants LimitMEMLOCK=infinity; without it the process refuses to start rather than serving without the guarantee, since "best effort" means it holds on some hosts and not others with nothing to say which. Memory encryption is reported rather than assumed: pinning keeps a key off the disk and does nothing about the DRAM, so the boot line names sev-snp, tdx or none and a deployment that needs one can be held to it. Off Linux these pages cannot be pinned, so egress refuses there rather than serving quietly without the property it is built on. The deploy doc states the other two guarantees that were true and unwritten: nothing is kept, so replicas are interchangeable and a suspect one is deleted rather than investigated; and --with-key is an operator's choice between host and tpm2 that egress never learns, with a cloud KMS or PKCS#11 HSM named as the integration it would take rather than a flag that exists.
20 lines
680 B
Go
20 lines
680 B
Go
// Copyright 2026 Hanzo AI, Inc.
|
|
// SPDX-License-Identifier: MIT OR Apache-2.0
|
|
|
|
//go:build !linux
|
|
|
|
package egress
|
|
|
|
import "errors"
|
|
|
|
// LockMemory refuses off Linux. mlockall is what keeps a provider key out of
|
|
// swap, and this service's whole claim is that a credential never reaches a
|
|
// disk — so a platform where that cannot be enforced is a platform it does not
|
|
// serve on, rather than one it serves on quietly without the guarantee.
|
|
func LockMemory() error {
|
|
return errors.New("lock memory: only Linux can pin these pages, and without pinning a provider key is swappable")
|
|
}
|
|
|
|
// MemoryEncryption is unknown off Linux.
|
|
func MemoryEncryption() string { return "unknown" }
|