Re: [PATCH -v5] random: introduce getrandom(2) system call

On Thu, Jul 24, 2014 at 8:18 AM, Henrique de Moraes Holschuh
[off-list ref] wrote:

On Thu, 24 Jul 2014, Theodore Ts'o wrote:

quoted

ERRORS
      EINVAL          An invalid flag was passed to getrandom(2)

      EFAULT          buf is outside the accessible address space.

      EAGAIN          The requested entropy was not available, and
                      getentropy(2) would have blocked if GRND_BLOCK flag
                      was set.

      EINTR           While blocked waiting for entropy, the call was
                      interrupted by a signal handler; see the description
                      of how interrupted read(2) calls on "slow" devices
                      are handled with and without the SA_RESTART flag
                      in the signal(7) man page.

Should we add E<SOMETHING> to be able to deny access to GRND_RANDOM or some
future extension ?

This might actually be needed sooner rather than later.  There are
programs that use containers and intentionally don't pass /dev/random
through into the container.  I know that Sandstorm does this, and I
wouldn't be surprised if other things (Docker?) do the same thing.

--Andy