Re: fopen mode for buffer clearing

[Adhemerval Zanella <adhemerval dot zanella at linaro dot org>]

On 13/04/2017 06:41, Florian Weimer wrote:
> We used to use mmap for the internal FILE * buffer.  This had the side effect that after fclose, the data in the buffer may not be gone from the system as a whole, but it will definitely not be part of the address space of the process anymore.  This is desirable if the stdio stream functions are used to process sensitive data because it reduces the risk of leaks.
> 
> Would it make sense to add an fopen mode flag to indicate that the implementation should clear the buffer (with explicit_bzero) before deallocating it?  This would also apply to reallocating buffers in getline.
> 
> Thanks,
> Florian

I really dislike exposing implementation details in an API sense, it adds
compatibility issues for other libcs and in the case we want to change the 
internal implementation (since we not have an additional constraint).

Also, for security sensitive operation it would make sense to define an
specific buffer with setvbuf and then the application can control how to
deallocate the buffer.