Screen lock confidentiality

I disagree. I believe it's a matter of "we should take feasible steps towards maximizing security."

Treating anything less than exactly 100% secure as being the same as 0% secure is the sort of thing the cryptography/security people frequently do, which tends to set Linus off (and I agree with him.)

The troublesome feature in question seems to be "cryptsetup-suspend", which (according to the documentation) flushes all pending writes to disk and then purges the encryption (more relevantly here, *decryption*) keys from memory. After this point, up until cryptsetup-luksresume is executed to reload the key (presumably the result of the user reauthenticating themselves), any attempt to read from the encrypted block device will fail.

However, not all attempts to read from the *filesystem* will result in reads from the *block device*. Sometimes everything needed to read a file on that filesystem is still in the page cache, in which case that file -- one that is nominally stored on an encrypted filesystem for which the system does not have the decryption keys available -- is still readable.

The request is simple: provide some sort of method to tell the kernel to evict as much information as possible from its own caches. The article points out that there are many cases where a page cannot be evicted:

1. It's part of an active vmsplice call
2. It's part of a DMA operation (especially an RDMA operation)
3. It's mapped as executable code (e.g. a running binary)

I would expect (and based on the article, the kernel devs agree with me) that the overwhelming majority of the files one would be interested in keeping secret don't fall into any of these categories. I'm not likely to be vmsplicing or RDMAing my SSH private key anywhere.

It *is* quite reasonable for me to be executing code from an encrypted block device -- as a software developer, a *lot* of the executables that I run are from my home directory, because I just compiled them. But I'm not super concerned about someone gaining access to such an executable via the page cache. And if I *am*, well, then it's on me to make sure I kill that process before I close the lid on my laptop.