memlockd(8)

💖 memlockd — the girlies' guide to locking files in RAM 💖

okay bestie, so this is memlockd(8), a page from the System Manager's Manual, and it's literally about a daemon that locks files in memory. no cap. let's get into it 🫶

✨ NAME ✨

memlockd — daemon to lock files in memory with mlock 🔒🧠

🌸 SYNOPSIS 🌸

memlockd [ -c config-file ] [ -d ] [ -f ] [ -u user ]

that's it. that's the whole vibe. four options, maximum slay ✨

🦋 DESCRIPTION 🦋

so this manual page documents briefly the memlockd command — yes bestie, briefly, we're not writing a novel here 💅

here's the tea though, and it's actually iconic: memlockd locks your system programs and config files in memory. why? because if a DOS attack hits, the sys-admin has a significantly increased chance of regaining control of the system in a reasonable amount of time — and therefore a reasonable chance of discovering the actual cause of the problem. the way that a locked-in-RAM config file can save your whole entire day 😭👑

like, imagine being under attack and still being able to read your own config. that's main character energy fr fr.

💅 OPTIONS 💅

• -c config-file — this one tells memlockd the fully-qualified path name to a config file that lists the names of the files to lock. if you don't specify a config file, it just defaults to /etc/memlockd.cfg. and here's the cute part: in any situation where a config file is used, a directory can be used instead — and if you hand it a directory, every file ending in ".cfg" gets processed. obsessed 🎀
• -d — debugging mode, bestie 🔍. the program will not fork, and it'll produce its logging messages on stderr instead of via syslog. perfect for when you want the drama right there in your terminal.
• -f — foreground (non-daemon) mode 🌞. the program will not fork, but it will still log normally. so it's the chill version — no forking, but the logging keeps its usual routine.
• -u user — specifies the name of a user to use for running ldd (for recursive operation) 👀. now listen, important: locking shared objects that are writable by non-root is not safe, but using a different UID will reduce the risk. so like... it's not a fix, it's a mitigation. noted. periodt.

🍓 what goes in the config file 🍓

the config file will contain a number of fully qualified names of files to lock in RAM. got it? good. now for the fun prefix characters, because this is where it gets spicy 🔥

• prefix a file name with a + character — when locking shared objects and ELF binaries, this tells memlockd that it should recursively lock all shared objects that the program requires, and all shared objects that those objects require. recursion girlies rise up 🧚
• prefix a file name with a ? character — use this when a file not found error doesn't matter (EG: you want a single config file to have the file names for multiple architectures or systems, iconic move honestly). but heads up — in that case, errors such as EPERM will still be logged. the ? only silences the not-found one, bestie, don't get it twisted 💀
• if a line in the config file starts with a % character, it will be taken as the name of a config file or directory to process 📁. and ngl, currently only one level of recursion is accepted. just one. don't try to go deeper, she said what she said 🙈

🌈 SEE ALSO 🌈

mlock(2), mmap(1).

👑 AUTHOR 👑

memlockd was written by Russell Coker <russell@coker.com.au> 💌

and that's the whole page, bestie!! it lives in the System Manager's Manual and signs off as memlockd(8). go lock something in memory, you absolute legend 🎀✨💖