config: add option to disable memory hardening
What the developer wrote
Authored by ThomasV
config: add option to disable memory hardening
This is needed for running with a memory profiler
What changed, and why it matters
This commit adds a command-line option to turn off a Linux memory-protection feature in Electrum. The option is mainly intended for developers using memory profilers, but it is also automatically enabled on Android builds. It does not by itself create a vulnerability, but it gives users a way to weaken a security hardening mechanism.
No immediate action required. Treat as a configuration feature. If auditing, verify that the Android default disabling of hardening is intentional and documented, and that the `--nohardening` flag is not exposed in ways that could be abused by malware or social engineering to weaken a running wallet's protections.
Security signals we found
Adds a way to disable memory hardening (PR_SET_DUMPABLE / mlockall-style protections)
Android QML path now disables memory hardening by default
Commit message frames change as a developer/profiling convenience, not a security fix
Evidence from the diff
The patch introduces a new global CLI flag --nohardening mapped to DISABLE_MEMORY_HARDENING_LINUX, plus a corresponding ConfigVar. On Linux, Electrum normally calls electrum.harden_memory_linux.set_dumpable_safe(False) to restrict memory dumps. The new option skips that call when set. The Android QML launcher path is also changed to set this option to True, replacing the previous is_android check in the hardening condition. The commit message states the option is needed for running with a memory profiler.
Changed components
electrum/commands.pyelectrum/simple_config.pyrun_electrumelectrum/harden_memory_linux.py (behavior conditional on new flag)Inspect captured patch +8 / −1
diff --git a/electrum/commands.py b/electrum/commands.py
index ea57c78..aa3321c 100644
--- a/electrum/commands.py
+++ b/electrum/commands.py
@@ -2462,6 +2462,10 @@ def add_global_options(parser, suppress=False):
group.add_argument(
"--forgetconfig", action="store_true", dest=SimpleConfig.CONFIG_FORGET_CHANGES.key(), default=None,
help=argparse.SUPPRESS if suppress else "Forget config on exit")
+ group.add_argument(
+ # Note: default value is False and not None, so that behaviour cannot be modified by editing the config file
+ "--nohardening", action="store_true", dest=SimpleConfig.DISABLE_MEMORY_HARDENING_LINUX.key(), default=False,
+ help=argparse.SUPPRESS if suppress else "Disable memory hardening (linux)")
def get_simple_parser():
diff --git a/electrum/simple_config.py b/electrum/simple_config.py
index 4258cbe..cf76ffa 100644
--- a/electrum/simple_config.py
+++ b/electrum/simple_config.py
@@ -794,6 +794,8 @@ Warning: setting this to too low will result in lots of payment failures."""),
RPC_SOCKET_TYPE = ConfigVar('rpcsock', default='auto', type_=str)
RPC_SOCKET_FILEPATH = ConfigVar('rpcsockpath', default=None, type_=str)
+ DISABLE_MEMORY_HARDENING_LINUX = ConfigVar('nohardening', default=None, type_=bool) # default is False in add_global_options
+
GUI_NAME = ConfigVar('gui', default='qt', type_=str)
CURRENT_WALLET = ConfigVar('current_wallet', default=None, type_=str)
diff --git a/run_electrum b/run_electrum
index 42f77a3..8ee74de 100755
--- a/run_electrum
+++ b/run_electrum
@@ -408,6 +408,7 @@ def main():
'cmd': 'gui',
SimpleConfig.GUI_NAME.key(): 'qml',
SimpleConfig.WALLET_SHOULD_USE_SINGLE_PASSWORD.key(): True,
+ SimpleConfig.DISABLE_MEMORY_HARDENING_LINUX.key(): True,
}
SimpleConfig.set_chain_config_opt_based_on_android_packagename(config_options)
else:
@@ -458,7 +459,7 @@ def main():
print_stderr('unknown command:', uri)
sys.exit(1)
- if sys.platform == "linux" and not is_android:
+ if sys.platform == "linux" and not config.DISABLE_MEMORY_HARDENING_LINUX:
import electrum.harden_memory_linux
electrum.harden_memory_linux.set_dumpable_safe(False)
Why this scored 23/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.