linux-kernel - Re: [PATCH v4] binfmt_elf.c: use get_random

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 07 Nov 2013 06:13:08 +0100
From:	Stephan Mueller <stephan.mueller@...ec.com>
To:	Jeff Liu <jeff.liu@...cle.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Kees Cook <keescook@...omium.org>,
	Andreas Dilger <aedilger@...il.com>,
	"viro@...iv.linux.org.uk" <viro@...iv.linux.org.uk>,
	"arnd@...db.de" <arnd@...db.de>, Ted Ts'o <tytso@....edu>,
	jakub@...hat.com, drepper@...hat.com,
	James Morris <james.l.morris@...cle.com>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v4] binfmt_elf.c: use get_random_int() to fix entropy depleting

Am Donnerstag, 7. November 2013, 12:14:17 schrieb Jeff Liu:

Hi Jeff,

>Hi Stephan,
>
>As per your previous comments for this fix, you have promised another
>approach which is promising to avoid entropy starvation, I got this
>info from the following thread: [PATCH] avoid entropy starvation due
>to stack protection
>https://lkml.org/lkml/2012/12/14/267

There are several solutions:

- Ted is trying to prevent a constant reseeding of the nonblocking_pool 
from the input_pool with a set of patches. I am unsure whether these 
patches find their way into the kernel. With those patches, we can 
happily keep get_random_bytes without too much strain on the input_pool 
entropy -- i.e. drop the conversion to get_random_int.

- The begin of the email thread contains a patch that adds a new pool 
which I called the kernel_pool that is just just for kernel internal 
purposes. With Teds proposed changes to nonblocking_pool, 
nonblocking_pool would behave almost like my kernel_pool and thus my 
kernel_pool patch would not be needed.

- Lastly I am trying to add a new seed source to random.c and kernel 
crypto API which could also be used as a stand-alone noise source. That 
proposed noise source would effectively alleviate a lot of entropy 
problems. The discussion for inclusion is raging at 
http://lkml.org/lkml/2013/10/11/582. Ted is having concerns and we are 
in a discussion to address those.
>
>My current fix has been merged into Andrew's tree(marked in "stuck"
>state) for a long time, and it also works well in our internal
>specific kernel, I'd like to know if there is any update from you, so
>that we can move it along for mainline. :)
>
>Thanks,
>-Jeff


Ciao
Stephan

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/