Irrlich

Overview

Irrlich is a specialized security daemon written in Rust, designed to protect sensitive runtime secrets (like master credentials, passwords, and cryptographic keys) from common extraction vectors. It enforces low-level operating system constraints, swap-locks memory blocks, and registers self-pipe signal handlers to guarantee memory zeroization on unexpected process termination.

Built with safety and isolation in mind, Irrlich operates as a zero-dependency local daemon suitable for storage vaults, authentication backends, and cryptographic key managers.

Core Security Safeguards

POSIX Process Hardening

• Disable Core Dumps: Disables core dumps globally by setting RLIMIT_CORE to zero, ensuring keys are never leaked to disk during unexpected crashes.
• No Ptracer Tracing: Configures PR_SET_DUMPABLE to false and blocks tracing using PR_SET_PTRACER, preventing debuggers (like GDB) or malicious sibling processes from dumping the application memory.

Memory Protection & Swap Locking

• Page-Locked Allocation: Wraps sensitive data in a custom LockedBuf structure, applying the POSIX mlock syscall to lock the page in RAM. This prevents the OS from flushing key material to swap space on disk.
• Page Alignment: Ensures allocations are strictly page-aligned, avoiding accidental bleeding of unmanaged data onto shared pages.
• Temporary Read/Write Access: Restricts write and read access to temporary closures, minimizing the duration that sensitive buffers are exposed in plaintext.

Signal-Safe Volatile Zeroization

• Self-Pipe Cleanup Registry: Registers real-time signal handlers (for SIGINT, SIGTERM, etc.). Upon receiving a terminate request, the daemon triggers a volatile zeroization routine that wipes all protected buffers from memory before the process shuts down.

Constant-Time Validation & Encryption

• Timing Attack Protections: Performs comparisons of passwords and keys using constant-time cryptographic validation helpers.
• Key Derivation & Vaults: Derives cryptographic keys using Argon2id and encrypts sensitive vaults using ChaCha20Poly1305 authenticated encryption.

Running & Verification

Irrlich is built with a pure Rust standard library and compiles directly with Cargo:

Build and Run from Source

Non-Interactive Test Run

To run verification diagnostics non-interactively (ideal for automated CI/CD configurations):