Merge branch 'main' into feat/improved-memfd-allocation

rosenpass/Cargo.toml

@@ -52,4 +52,5 @@ serial_test = {workspace = true}
 procspawn = {workspace = true}
 
 [features]
-enable_broker_api = ["rosenpass-wireguard-broker/enable_broker_api"]
+enable_broker_api = ["rosenpass-wireguard-broker/enable_broker_api"]
+enable_memfd_alloc = []

rosenpass/src/cli.rs

@@ -3,7 +3,9 @@ use clap::{Parser, Subcommand};
 use rosenpass_cipher_traits::Kem;
 use rosenpass_ciphers::kem::StaticKem;
 use rosenpass_secret_memory::file::StoreSecret;
-use rosenpass_secret_memory::secret_policy_try_use_memfd_secrets;
+use rosenpass_secret_memory::{
+    secret_policy_try_use_memfd_secrets, secret_policy_use_only_malloc_secrets,
+};
 use rosenpass_util::file::{LoadValue, LoadValueB64};
 use rosenpass_wireguard_broker::brokers::native_unix::{
     NativeUnixBroker, NativeUnixBrokerConfigBaseBuilder, NativeUnixBrokerConfigBaseBuilderError,
@@ -156,7 +158,11 @@ impl CliCommand {
     /// - This method consumes the [`CliCommand`] value. It might be wise to use a reference...
     pub fn run(self, test_helpers: Option<AppServerTest>) -> anyhow::Result<()> {
         //Specify secret policy
+
+        #[cfg(feature = "enable_memfd_alloc")]
         secret_policy_try_use_memfd_secrets();
+        #[cfg(not(feature = "enable_memfd_alloc"))]
+        secret_policy_use_only_malloc_secrets();
 
         use CliCommand::*;
         match self {

rp/Cargo.toml

@@ -37,3 +37,6 @@ netlink-packet-wireguard = "0.2"
 [dev-dependencies]
 tempfile = {workspace = true}
 stacker = {workspace = true}
+
+[features]
+enable_memfd_alloc = []

rp/src/main.rs

@@ -11,7 +11,10 @@ mod key;
 
 #[tokio::main]
 async fn main() {
+    #[cfg(feature = "enable_memfd_alloc")]
     policy::secret_policy_try_use_memfd_secrets();
+    #[cfg(not(feature = "enable_memfd_alloc"))]
+    policy::secret_policy_use_only_malloc_secrets();
 
     let cli = match Cli::parse(std::env::args().peekable()) {
         Ok(cli) => cli,