Linux 5.14 will support the creation of secret memory areas

Following Linux 5.13, Linux 5.14 will also support the creation of secret memory areas. This function is implemented by memfd_secret(). memfd_secret() is a specialized system call, not an extension of memfd_create(), its purpose is to allow users to create a more secure memory map, rather than simply allowing file-based memory access. According to the description, the secret memory area created by memfd_secret() is only visible to the owning process and will not be mapped to other processes or kernel page tables. Therefore, it can be used to store the private key for OpenSSL in the user space on Linux, and reduce the possibility of the private key being exposed in the system memory when it is not protected by any other hardware encryption.

This work originated from IBM engineer Mike Rapoport. He proposed a “MAP_EXCLUSIVE” flag for the Linux kernel memory management code in 2019 to support the mapping that only the owning process can see. The secret memory support of memfd_secret() is an evolution of the same concept.