Module secure_mem 

Secure memory utilities for key material.

Wraps libc::mlock/munlock to prevent key bytes from being swapped to disk. mlock is best-effort: if the OS refuses (e.g. RLIMIT_MEMLOCK exceeded on some container configurations), a warning is logged and startup continues. Failing to mlock does not expose the key — it only means the key could be paged out under extreme memory pressure.

On platforms where mlock is not available (e.g. some WASM targets) the calls are no-ops.

Structs

SecureKey

A 32-byte key held in memory, mlocked against swap.

Functions

mlock_key_bytes

Public convenience wrapper for mlocking raw key bytes from crypto.rs.