zero sensitive information with explicit_bzero

GrapheneOS · Jun 1, 2020 · aa9cc05 · aa9cc05
1 parent 0961441
commit aa9cc05
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/init/security.cpp b/init/security.cpp
@@ -73,6 +73,7 @@ Result<Success> MixHwrngIntoLinuxRngAction(const BuiltinArguments&) {
         }
 
         chunk_size = TEMP_FAILURE_RETRY(write(urandom_fd, buf, chunk_size));
+        explicit_bzero(buf, chunk_size);
         if (chunk_size == -1) {
             return ErrnoError() << "Failed to write to /dev/urandom";
         }