From 342c0f340c29a588ff005ad718731eb6a111f325 Mon Sep 17 00:00:00 2001
From: Norbert Pocs <norbertp@openssl.org>
Date: Mon, 14 Jul 2025 15:59:07 +0200
Subject: [PATCH] Update doc on CRYPTO_MEM_SEC(_MINSIZE)

Signed-off-by: Norbert Pocs <norbertp@openssl.org>

Reviewed-by: Neil Horman <nhorman@openssl.org>
Reviewed-by: Paul Dale <ppzgs1@gmail.com>
(Merged from https://github.com/openssl/openssl/pull/28036)
---
 doc/man7/openssl-env.pod | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/doc/man7/openssl-env.pod b/doc/man7/openssl-env.pod
index 78043d5bd68..51c0741846a 100644
--- a/doc/man7/openssl-env.pod
+++ b/doc/man7/openssl-env.pod
@@ -51,6 +51,20 @@ See L<OPENSSL_malloc(3)>.
 Specifies the directory from which cryptographic providers are loaded.
 Equivalently, the generic B<-provider-path> command-line option may be used.
 
+=item B<OPENSSL_SEC_MEM>
+
+Initializes the secure memory at the beginning of the application which makes
+the secure memory calls not to fall back to regular memory calls. The value
+indicates the B<size> parameter in bytes. The value can be expressed in
+binary, octal, decimal and hexadecimal. For formatting see B<strtol(3)>.
+For further restrictions see L<CRYPTO_secure_malloc_init(3)>.
+
+=item B<OPENSSL_SEC_MEM_MINSIZE>
+
+An optional variable used with B<OPENSSL_SEC_MEM>. The value indicates
+B<minsize> parameter in bytes. The same formatting applies as above.
+Default is 0. For more info see L<CRYPTO_secure_malloc_init(3)>.
+
 =item B<OPENSSL_TRACE>
 
 By default the OpenSSL trace feature is disabled statically.
-- 
2.47.2