Change MlockDisabled to MlockEnabled

helper/pluginutil/runner.go

@@ -21,7 +21,7 @@ type Looker interface {
 // configuration and wrapping data in a respose wrapped token.
 type Wrapper interface {
 	ResponseWrapData(data map[string]interface{}, ttl time.Duration, jwt bool) (*wrapping.ResponseWrapInfo, error)
-	MlockDisabled() bool
+	MlockEnabled() bool
 }
 
 // LookWrapper defines the functions for both Looker and Wrapper
@@ -63,17 +63,14 @@ func (r *PluginRunner) Run(wrapper Wrapper, pluginMap map[string]plugin.Plugin,
 		return nil, err
 	}
 
-	mlock := "true"
-	if wrapper.MlockDisabled() {
-		mlock = "false"
-	}
-
 	cmd := exec.Command(r.Command, r.Args...)
 	cmd.Env = append(cmd.Env, env...)
 	// Add the response wrap token to the ENV of the plugin
 	cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%s", PluginUnwrapTokenEnv, wrapToken))
 	// Add the mlock setting to the ENV of the plugin
-	cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%s", PluginMlockEnabled, mlock))
+	if wrapper.MlockEnabled() {
+		cmd.Env = append(cmd.Env, fmt.Sprintf("%s=%s", PluginMlockEnabled, "true"))
+	}
 
 	secureConfig := &plugin.SecureConfig{
 		Checksum: r.Sha256,

logical/system_view.go

@@ -49,8 +49,9 @@ type SystemView interface {
 	// name. Returns a PluginRunner or an error if a plugin can not be found.
 	LookupPlugin(string) (*pluginutil.PluginRunner, error)
 
-	// MlockDisabled returns the configuration setting for DisableMlock.
-	MlockDisabled() bool
+	// MlockEnabled returns the configuration setting for Enableing mlock on
+	// plugins.
+	MlockEnabled() bool
 }
 
 type StaticSystemView struct {
@@ -60,7 +61,7 @@ type StaticSystemView struct {
 	TaintedVal          bool
 	CachingDisabledVal  bool
 	Primary             bool
-	DisableMlock        bool
+	EnableMlock         bool
 	ReplicationStateVal consts.ReplicationState
 }
 
@@ -96,6 +97,6 @@ func (d StaticSystemView) LookupPlugin(name string) (*pluginutil.PluginRunner, e
 	return nil, errors.New("LookupPlugin is not implemented in StaticSystemView")
 }
 
-func (d StaticSystemView) MlockDisabled() bool {
-	return d.DisableMlock
+func (d StaticSystemView) MlockEnabled() bool {
+	return d.EnableMlock
 }

vault/core.go

@@ -338,7 +338,7 @@ type Core struct {
 	// pluginCatalog is used to manage plugin configurations
 	pluginCatalog *PluginCatalog
 
-	disableMlock bool
+	enableMlock bool
 }
 
 // CoreConfig is used to parameterize a core
@@ -441,7 +441,7 @@ func NewCore(conf *CoreConfig) (*Core, error) {
 		clusterName:                      conf.ClusterName,
 		clusterListenerShutdownCh:        make(chan struct{}),
 		clusterListenerShutdownSuccessCh: make(chan struct{}),
-		disableMlock:                     conf.DisableMlock,
+		enableMlock:                      !conf.DisableMlock,
 	}
 
 	// Wrap the physical backend in a cache layer if enabled and not already wrapped

vault/dynamic_system_view.go

@@ -123,7 +123,7 @@ func (d dynamicSystemView) LookupPlugin(name string) (*pluginutil.PluginRunner,
 	return d.core.pluginCatalog.Get(name)
 }
 
-// MlockDisabled returns the configuration setting "DisableMlock".
-func (d dynamicSystemView) MlockDisabled() bool {
-	return d.core.disableMlock
+// MlockEnabled returns the configuration setting for enabling mlock on plugins.
+func (d dynamicSystemView) MlockEnabled() bool {
+	return d.core.enableMlock
 }