Struct SecMem 

pub struct SecMem<S: Zeroize> { /* private fields */ }

Available on Unix and crate feature sec_mem only.

A hardware-accelerated secure memory container for isolating sensitive data from the OS.

SecMem uses raw Linux syscalls (mmap, mprotect, mseal, mlock) and Intel Memory Protection Keys (MPK/WRPKRU) to physically isolate cryptographic keys or passwords from the rest of the process. It strictly guards against buffer overflows via msealed guard pages, and actively prevents memory dumping using MADV_DONTDUMP, MADV_DONTFORK, and PR_SET_DUMPABLE(0).

When the encryption feature is enabled, data is permanently blinded at rest in RAM using ChaCha20. It utilizes OpenSSH-style Key Shielding, splitting a massive 16 KiB pre-key buffer across kernel memfd_secret mappings and dynamically deriving the true key using blake3. This mathematically neutralizes /proc/self/mem dumping, physical cold-boot attacks, and side-channel exploits like Spectre or Rowhammer.

Examples

use sec_mem::SecMem;

// Create a highly protected memory vault
let mut secure_key = SecMem::new([0xAAu8; 32]);

// Access is granted exclusively within this closure bounds
secure_key.access_mut(|key| {
    key[0] = 0xBB;
    // Data is processed here...
}); 
// Instantly upon closure exit, memory is zeroized, re-encrypted, and hardware-locked.

Implementations

impl<S: Zeroize> SecMem<S>

pub fn new(secret: S) -> Self

Creates a new protected secret

pub fn access<F, R>(&self, f: F) -> R

where F: FnOnce(&S) -> R,

Access secret for reading

pub fn access_mut<F, R>(&mut self, f: F) -> R

where F: FnOnce(&mut S) -> R,

Access secret for mutation

pub fn constant_time_eq(&self, other: &Self) -> Choice

where S: AsRef<[u8]>,

Constant-time equality comparison

pub fn seal_guard_pages(&self)

Explicitly applies Linux memory sealing (mseal) to the guard pages.

WARNING: mseal permanently locks the memory region’s permissions. Because Linux prevents munmap on sealed memory, calling this method means the guard pages (and thus the allocation) will leak and remain in RAM until the process terminates. It should only be used for global, long-lived singletons (like root application keys). Requires Linux 6.10+. Fails silently on older kernels.

Trait Implementations

impl<S: Zeroize + Clone> Clone for SecMem<S>

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<S: Zeroize + Debug> Debug for SecMem<S>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<S: Zeroize + Default> Default for SecMem<S>

fn default() -> Self

Returns the “default value” for a type.

impl<S: Zeroize> Drop for SecMem<S>

fn drop(&mut self)

Executes the destructor for this type.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.

impl<T: Zeroize> SecretAccess<T> for SecMem<T>

fn access<F, R>(&self, f: F) -> R

where F: FnOnce(&T) -> R,

Access the underlying data for reading

fn access_mut<F, R>(&mut self, f: F) -> R

where F: FnOnce(&mut T) -> R,

Access the underlying data for mutation

impl<const N: usize> SecretAccess<[u8]> for SecMem<[u8; N]>

fn access<F, R>(&self, f: F) -> R

where F: FnOnce(&[u8]) -> R,

Access the underlying data for reading

fn access_mut<F, R>(&mut self, f: F) -> R

where F: FnOnce(&mut [u8]) -> R,

Access the underlying data for mutation

impl SecretAccess<[u8]> for SecMem<Vec<u8>>

fn access<F, R>(&self, f: F) -> R

where F: FnOnce(&[u8]) -> R,

Access the underlying data for reading

fn access_mut<F, R>(&mut self, f: F) -> R

where F: FnOnce(&mut [u8]) -> R,

Access the underlying data for mutation

impl<S: Zeroize + Send> Send for SecMem<S>

impl<S: Zeroize + Sync> Sync for SecMem<S>

impl<S: Zeroize> Zeroize for SecMem<S>

fn zeroize(&mut self)

Zero out this object from memory using Rust intrinsics which ensure the zeroization operation is not “optimized away” by the compiler.

impl<S: Zeroize> ZeroizeOnDrop for SecMem<S>