Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I would like to open/decrypt an encrypted gpg/pgp file in the main memory without leaving any footprints on the file system including swap,etc.
what is the safest option on a gnu/linux debian from this selection:
is there a better way?
What is a memory based file system (RAM disk)?
A memory based file system is something which creates a storage area directly in a computers RAM as if it were a partition on a disk drive. As RAM is a volatile type of memory which means when the system is restarted or crashes the file system is lost along with all it’s data.
Both tmpfs and ramfs mount will give you the power of fast reading and writing files from and to the primary memory. When you test this on a small file, you may not see a huge difference. You’ll notice the difference only when you write large amount of data to a file with some other processing overhead such as network.
RAMFS and TMPFS
tmpfs is supported by the Linux kernel from version 2.4. tmpfs (also known as shmfs) is based on ramfs code and is used during bootup and also uses the page cache, but unlike ramfs it supports swapping out less-used pages to swap space as well as filesystem size and inode limits to prevent out of memory situations (defaulting to half of physical RAM and half the number of RAM pages, respectively). ramfs, in contrast, does not make use of swap.
tmpfs vs. ramf
The two main RAM based file system types in Linux are tmpfs and ramfs. ramfs is the older file system type and is largely replaced in most scenarios by tmpfs.
The Difference Between a tmpfs and ramfs RAM Disk
There are two file system types built into most modern Linux distributions which allow you to create a RAM based storage area which can be mounted and used link a normal folder.
Before using this type of file system you must understand the benefits and problems of memory file system in general, as well as the two different types. The two types of RAM disk file systems are tmpfs and ramfs and each type has it’s own strengths and weaknesses.
Disadvantages of Ramfs and Tmpfs
Since both ramfs and tmpfs is writing to the system RAM, it would get deleted once the system gets rebooted, or crashed. So, you should write a process to pick up the data from ramfs/tmpfs to disk in periodic intervals. You can also write a process to write down the data from ramfs/tmpfs to disk while the system is shutting down. But, this will not help you in the time of system crash.
use tmpfs and disable swap on your system check if that worls for you Instead of disabling swap, just make it small (like 32MB or something; whatever the smallest allowable partition size is). The kernel needs swap to operate optimally, even if it's extremely small. Just make sure it's there.
ramfs
ramfs creates an in memory file system which uses the same mechanism and storage space as Linux file system cache. Running the command free in Linux will show you the amount of RAM you have on your system, including the amount of file system cache in use. The below is an example of a 31GB of ram in a production server.
tmpfs
recent RAM file system which overcomes many of the drawbacks with ramfs. You can specify a size limit in tmpfs which will give a ‘disk full’ error when the limit is reached. This behaviour is exactly the same as a partition of a physical disk.
From:
Overview of RAMFS and TMPFS on Linux Overview
The Difference Between a tmpfs and ramfs RAM Disk Difference
How to make tmpfs to use only the physical RAM and not the swap? tmpfs no swap
I would use tmpfs and maybe disable and delete swap completely, but it may be that your system is no longer running properly or is stuck. of course it also depends on your whole system, is it a desktop or just a shell system. what software is still running in the background. try and check
tmpfs (and by extension /tmp on most systems), will swap if necessary :
A tmpfs filesystem has the following properties:
- The filesystem can employ swap space when physical memory pressure demands it.
From man 5 tmpfs
ramfs is the predecessor to tmpfs and doesn't swap
One downside of ramfs is you can keep writing data into it until you fill up all memory, and the VM can’t free it because the VM thinks that files should get written to backing store (rather than swap space), but ramfs hasn’t got any backing store. Because of this, only root (or a trusted user) should be allowed write access to a ramfs mount.
From the Kernel documentation
If the ramdisk you mention is what's written here (from the above link) :
The older “ram disk” mechanism created a synthetic block device out of an area of RAM and used it as backing store for a filesystem. This block device was of fixed size, so the filesystem mounted on it was of fixed size. Using a ram disk also required unnecessarily copying memory from the fake block device into the page cache (and copying changes back out), as well as creating and destroying dentries. Plus it needed a filesystem driver (such as ext2) to format and interpret this data.
The doc has that to say about ramdisk :
Compared to ramfs, this wastes memory (and memory bus bandwidth), creates unnecessary work for the CPU, and pollutes the CPU caches. (There are tricks to avoid this copying by playing with the page tables, but they’re unpleasantly complicated and turn out to be about as expensive as the copying anyway.) More to the point, all the work ramfs is doing has to happen anyway, since all file access goes through the page and dentry caches. The RAM disk is simply unnecessary; ramfs is internally much simpler.
ramdisk?