memory_locker 1.0.2 → 1.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 39ab9db08583b52b0d784c5d9f9cc259ca4233523cd1389be309f55339add449
-  data.tar.gz: 5756d015e348eb03f69e23c6c2ee214f9d9db736cb0de50a00e38bb3f81570c7
+  metadata.gz: a4bc016f2294342753deae3eda56b89e55b5345474f12603919b5063dc441045
+  data.tar.gz: ac399821325952ee575fcc226de9edc41c14139a078ae33eb1c7584f24033f54
 SHA512:
-  metadata.gz: d85352a114f15abd76ec140ca38a15c828a8c4cf4a21f8709db8a9a2f3b0bfd3dd686e6bc9a510b97cccb7a19ca08475fbdcc3e2ac47440fca5df7104815744c
-  data.tar.gz: f68c19229a9127e740a6e54cfd4fa3a2c3bb2f3faec579d8a2eb3c5456d6f0a9ac7a12ae46a3ef6c5c6d8de3f5d0960855b2e12ff07d817afecc4a8ceaf0ea1c
+  metadata.gz: 4a9ad9fc290ccbe7ce4fc0fe6a52d1bce11b0fb0899721c5e4e6492f14f54811f4f630faf632dc9e7b6afc944cc22a7b188d90b3dbd6065d79b98f17e5805944
+  data.tar.gz: d92c5be22a0b00041829053f32bc61a6c46ce63987062584956413da81832b44046dbe50b0d14e6c8bdc9b3a1c9b121b0f76612a9741c1ec65a985fa731a760a

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## [1.0.3] - 2023-11-12
+
+- Use Fiddle (part of Ruby standard library) instead of FFI gem
+
 ## [1.0.2] - 2023-07-28
 
 - Don't load libc if already loaded in the current process

data/README.md

@@ -1,4 +1,5 @@
 # MemoryLocker
+
 [![Gem Version](https://badge.fury.io/rb/memory_locker.svg)](https://badge.fury.io/rb/memory_locker)
 
 Lock memory containing sensitive data (such as passwords or cryptographic keys) to prevent it from being swapped
@@ -7,7 +8,7 @@ by the kernel, which allows the attacker with access to swap space to recover se
 ## How it works
 
 Ruby doesn't allow granular memory management, therefore the approach is to lock the entire memory of a current
-process using `mlockall()`.
+process using [mlockall()](https://linux.die.net/man/2/mlockall).
 
 The memory will stay locked until the process terminates. Although unlocking memory is technically possible,
 the gem doesn't allow it. The reason is Ruby doesn't support reliable removal of secrets from memory,
@@ -19,47 +20,31 @@ Subprocesses don't inherit memory locking. Make sure to lock memory in each one
 
 ## Requirements
 
-This gem requires [ffi gem](https://github.com/ffi/ffi), which needs to be built on install.
-In case of build-related issues, make sure you have the compiler installed.
-Refer to gem documentation for instructions.
-
-Also, an OS supporting `mlockall()` is required. Those include most Unixes except macOS. Windows is not supported.
+OS support for [mlockall()](https://linux.die.net/man/2/mlockall) is required.
+Will work on most Unixes except macOS. Windows is not supported.
 
 ## Installation
 
-    $ gem install memory_locker
+    gem install memory_locker
 
 ## Usage
 
-### Enforced installation
-
 To lock the memory of your process, add the following code early in the app lifetime:
 
     require 'memory_locker'
-    MemoryLocker.call
-
-### Optional installation
-
-If you don't want to force the user to install `memory_locker` gem, you can make it optional.
-If the user doesn't have it installed, the warning will appear, but your app will run.
-
-    begin
-      require 'memory_locker'
-    rescue LoadError
-      warn 'Failed to lock memory. To fix install `memory_locker` gem.'
-    else
-      MemoryLocker.call
-    end
+    MemoryLocker.call     # short syntax
+    MemoryLocker.new.call # if you prefer to use instance explicitly
 
 ## Exceptions
 
-If your OS is unsupported or there was a locking error, you will get an exception descending from MemoryLocker::Error.
+If your OS is unsupported or there is a locking error, you will get an exception descending from `MemoryLocker::Error`.
 
 ## Testing
 
-Locking the memory of your app when testing is not needed, and if you use an unsupported OS will brake your app.
+Locking the memory of your app when testing is not needed, and if you use an unsupported OS will break your app.
 
-As only the `#call` method is being used, you can easily replace `MemoryLocker` with empty lambda `->{}`.
+As only the `#call` method is being used, you can easily replace `MemoryLocker` class or instance with an empty
+lambda `->{}` in your tests.
 
 ## Development
 
@@ -72,7 +57,7 @@ push git commits and the created tag, and push the `.gem` file to [rubygems.org]
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/phantom-node/memory_locker.
+Bug reports and pull requests are welcome on GitHub at <https://github.com/phantom-node/memory_locker>.
 This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to
 the [code of conduct](https://github.com/phantom-node/memory_locker/blob/master/CODE_OF_CONDUCT.md).
 

data/lib/memory_locker/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class MemoryLocker
-  VERSION = '1.0.2'
+  VERSION = "1.0.3"
 end

data/lib/memory_locker.rb

@@ -1,39 +1,48 @@
 # frozen_string_literal: true
 
-require_relative 'memory_locker/version'
-require 'ffi'
+require_relative "memory_locker/version"
+require "fiddle"
 
 # Lock process memory, so it won't be swapped by the kernel.
 # It is implemented as a one-way operation: there is no unlock.
 # That's because it's hard to properly clean memory in Ruby.
 class MemoryLocker
-  Error             = Class.new StandardError
-  UnsupportedError  = Class.new Error
-  LibcNotFoundError = Class.new Error
-  LockingError      = Class.new Error
+  Error = Class.new StandardError
+  LockingError = Class.new Error
+  UnsupportedError = Class.new Error
+
+  # Those values should remain the same on all POSIX systems
+  MCL_CURRENT = 1
+  MCL_FUTURE = 2
+  private_constant :MCL_CURRENT, :MCL_FUTURE
 
   def call
-    result, errno = libc.mlockall
-    raise LockingError, "Locking of memory failed with errno #{errno}" unless result.zero?
+    raise LockingError, "Locking of memory failed" unless function.call(MCL_CURRENT | MCL_FUTURE).zero?
   end
 
   def self.call
-    new.call
+    new.send :call
   end
 
   private
 
-  attr_reader :libc
-
-  def initialize(libc_loader: -> { require_relative 'memory_locker/libc' },
-                 libc_fetcher: -> { Libc },
-                 unsupported_error: FFI::NotFoundError,
-                 libc_not_found_error: LoadError)
-    libc_loader.call
-    @libc = libc_fetcher.call
+  def function
+    lazy_function.call
   rescue unsupported_error => e
-    raise UnsupportedError, 'System does not support mlockall()', cause: e
-  rescue libc_not_found_error => e
-    raise LibcNotFoundError, 'Failed to find C library', cause: e
+    raise UnsupportedError, "Memory locking not supported: #{e.message}", cause: e
+  end
+
+  attr_reader :lazy_function, :unsupported_error
+
+  def initialize(
+    libc_path: nil,
+    function_name: "mlockall",
+    lazy_handle: -> { Fiddle.dlopen(libc_path)[function_name] },
+    lazy_function: -> { Fiddle::Function.new(lazy_handle.call, [Fiddle::TYPE_INT], Fiddle::TYPE_INT) },
+    unsupported_error: Fiddle::DLError
+  )
+
+    @lazy_function = lazy_function
+    @unsupported_error = unsupported_error
   end
 end

metadata

@@ -1,29 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: memory_locker
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.0.3
 platform: ruby
 authors:
 - Paweł Pokrywka
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-07-28 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: ffi
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.0.0
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: 1.0.0
+date: 2023-11-12 00:00:00.000000000 Z
+dependencies: []
 description: 
 email:
 - pepawel@users.noreply.github.com
@@ -35,7 +21,6 @@ files:
 - LICENSE.txt
 - README.md
 - lib/memory_locker.rb
-- lib/memory_locker/libc.rb
 - lib/memory_locker/version.rb
 homepage: https://github.com/phantom-node/memory_locker
 licenses:

data/lib/memory_locker/libc.rb

@@ -1,22 +0,0 @@
-# frozen_string_literal: true
-
-class MemoryLocker
-  # Low level interface to libc
-  module Libc
-    # Those values should remain the same on all POSIX systems
-    MCL_CURRENT = 1
-    MCL_FUTURE = 2
-
-    extend FFI::Library
-    # Try to load already loaded libc from the current process, use system libc as a fallback
-    ffi_lib [FFI::CURRENT_PROCESS, FFI::Library::LIBC]
-    attach_function :real_mlockall, :mlockall, [:int], :int
-
-    def self.mlockall
-      result = real_mlockall(MCL_CURRENT | MCL_FUTURE)
-      [result, FFI.errno]
-    end
-  end
-
-  private_constant :Libc
-end