lkml.org 
[lkml]   [2022]   [Mar]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] random: allow writes to /dev/urandom to influence fast init
    On Wed, Mar 23, 2022 at 01:53:03PM -0600, Jason A. Donenfeld wrote:
    > Hi David,
    >
    > On Wed, Mar 23, 2022 at 8:01 AM David Laight <David.Laight@aculab.com> wrote:
    > >
    > > From: Jason A. Donenfeld
    > > > Sent: 23 March 2022 04:48
    > > ...
    > > > - Plenty of things are seeding the RNG correctly, and buildroot's
    > > > shell script is just "doing it wrong".
    > > >
    > > > On that last point, I should reiterate that buildroot's shell script
    > > > still isn't actually initializing the RNG, despite what it says in its
    > > > echo; there's never been a way to initialize the RNG from a shell
    > > > script, without calling out to various special purpose ioctl-aware
    > > > binaries.
    > >
    > > Perhaps the very first write after boot could be assumed to
    > > be valid initialisation data?
    > > (On top of a few other tests.)
    >
    > I addressed this already earlier. That approach does not work. Too
    > many things already pass in garbage, not expecting for it to be
    > credited, but just contributory. /dev/urandom writes simply has never
    > had the semantics one would want for credited seeding. Adding a
    > heuristic like this will break users.
    >

    Just to give an example of this, one of the first things that Android does at
    boot time is copy the kernel command line into /dev/urandom:
    https://android.googlesource.com/platform/system/core/+/refs/heads/android12-release/rootdir/init.rc#122

    It would certainly be undesirable if that started crediting entropy, given that
    the command line might not contain much entropy, or any at all.

    (And yes, copying the kernel command line into /dev/urandom is redundant in
    kernels v4.14 and later due to https://git.kernel.org/linus/33d72f3822d7ff8a.
    But this is going to be kept around for a while longer due to older kernels.)

    - Eric

    \
     
     \ /
      Last update: 2022-03-24 19:02    [W:2.166 / U:1.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site