On Thu, 24 Jul 2014, Theodore Ts'o wrote:

On Thu, Jul 24, 2014 at 08:21:38AM -0700, Andy Lutomirski wrote:

quoted

quoted

Should we add E<SOMETHING> to be able to deny access to GRND_RANDOM or some
future extension ?

This might actually be needed sooner rather than later.  There are
programs that use containers and intentionally don't pass /dev/random
through into the container.  I know that Sandstorm does this, and I
wouldn't be surprised if other things (Docker?) do the same thing.

I wouldn't add the error to the man page until we actually modify the
kernel to add such a restriction.

By then, it might be too late.  It would be really sad to find ourselves
forced to return ENOSYS to getrandom(GRND_RANDOM) when we actually wanted to
return EPERM/EACCES.

Actually, we might not be able to do even that much: all it takes is for
someone to have the bright idea of deploying userspace code that checks for
ENOSYS only on a first "probe" getrandom() syscall without GRND_RANDOM, and
does something idiotic when it gets ENOSYS later on a
getrandom(GRND_RANDOM).  meh.  We can't even abuse the system ourselves :-)

However, the thought crossed my mind a while back that perhaps the
right answer is a cgroup controller which controls the rate at which a
process is allowed to drain entropy from the /dev/random pool.  This
could be set to 0, or it could be set to N bits per unit time T, and
if the process exceeded the value, it would just block or return
EAGAIN.  So instead of making it be just a binary "you have access" or

That will teach people to not have a SIGALRM on code that calls a blocking
syscall, I suppose.  Still, there is a risk it could cause so much bad
application behaviour to the point of being unusable.

Then I decided that it was overkill, but for people who are trying to

Indeed :p

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh