Re: [kernel-hardening] Re: Proposal for kernel self protection features - Yves-Alexis Perez

From: Yves-Alexis Perez <corsac@debian.org>
To: kernel-hardening@lists.openwall.com, Marcus Meissner <meissner@suse.de>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>,
	Theodore Tso <tytso@google.com>, Emese Revfy <re.emese@gmail.com>,
	Kees Cook <keescook@chromium.org>,
	PaX Team <pageexec@freemail.hu>,
	Brad Spengler <spender@grsecurity.net>,
	Greg KH <gregkh@linuxfoundation.org>,
	Josh Triplett <josh@joshtriplett.org>
Subject: Re: [kernel-hardening] Re: Proposal for kernel self protection features
Date: Tue, 10 Nov 2015 12:24:05 +0100	[thread overview]
Message-ID: <1447154645.29239.8.camel@debian.org> (raw)
In-Reply-To: <20151110104747.GG25737@suse.de>

[-- Attachment #1: Type: text/plain, Size: 685 bytes --]

On mar., 2015-11-10 at 11:47 +0100, Marcus Meissner wrote:
> The kernel has infrastructure for this (feeding hardware random generators
> into the random pool) these days.
> 
> e.g.
> drivers/char/hw_random/tpm-rng.c

Thanks, I was missing those bits. Actually those are in (on v4.3, starting
from drivers/char/hw_random/core.c#L483):

hwrng_register()
	add_early_randomness()
		rng_get_data()
		add_device_randomness()

but as far as I can tell it only gets called once when registering the hwrng
driver, and only if the RNG driver doesn't define an init function (tpm-rng
doesn't). But that's still better than no randomness at all.

Regards,
-- 
Yves-Alexis

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 473 bytes --]