From: Sasha Levin <levinsasha928@gmail.com>
To: Steve Grubb <sgrubb@redhat.com>
Cc: Ted Ts'o <tytso@mit.edu>, Jarod Wilson <jarod@redhat.com>,
linux-crypto@vger.kernel.org, Matt Mackall <mpm@selenic.com>,
Neil Horman <nhorman@redhat.com>,
Herbert Xu <herbert.xu@redhat.com>,
Stephan Mueller <stephan.mueller@atsec.com>,
lkml <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] random: add blocking facility to urandom
Date: Thu, 08 Sep 2011 00:38:31 +0300 [thread overview]
Message-ID: <1315431511.3576.66.camel@lappy> (raw)
In-Reply-To: <201109071728.31162.sgrubb@redhat.com>
On Wed, 2011-09-07 at 17:28 -0400, Steve Grubb wrote:
> On Wednesday, September 07, 2011 05:10:27 PM Sasha Levin wrote:
> > > > > > Something similar probably happens for getting junk on disks before
> > > > > > creating an encrypted filesystem on top of them.
> > > > >
> > > > > During system install, this sysctl is not likely to be applied.
> > > >
> > > > It may happen at any time you need to create a new filesystem, which
> > > > won't necessarily happen during system install.
> > > >
> > > > See for example the instructions on how to set up a LUKS filesystem:
> > > > https://wiki.archlinux.org/index.php/System_Encryption_with_LUKS#Prepar
> > > > atio n_and_mapping
> > >
> > > Those instructions might need to be changed. That is one way of many to
> > > get random numbers on the disk. Anyone really needing the security to
> > > have the sysctl on will also probably accept that its doing its job and
> > > keeping the numbers random. Again, no effect unless you turn it on.
> >
> > There are bunch of other places that would need to be changed in that
> > case :)
> >
> > Why not implement it as a user mode CUSE driver that would
> > wrap /dev/urandom and make it behave any way you want to? why push it
> > into the kernel?
>
> For one, auditing does not work for FUSE or things like that. We have to be able to
> audit who is using what. Then there are the FIPS-140 requirements and this will spread
> it. There are problems sending crypto audit events from user space, too.
auditd doesn't work with FUSE? afaik it should, FUSE is a filesystem
like any other.
--
Sasha.
next prev parent reply other threads:[~2011-09-07 21:38 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-09-02 14:37 [PATCH] random: add blocking facility to urandom Jarod Wilson
2011-09-05 2:36 ` Sandy Harris
2011-09-06 14:09 ` Stephan Mueller
2011-09-07 17:38 ` Jarod Wilson
2011-09-07 18:12 ` Sasha Levin
2011-09-07 18:26 ` Jarod Wilson
2011-09-07 19:05 ` Sasha Levin
2011-09-07 19:30 ` Jarod Wilson
2011-09-07 20:00 ` Sasha Levin
2011-09-07 19:35 ` Neil Horman
2011-09-07 19:27 ` Ted Ts'o
2011-09-07 19:36 ` Jarod Wilson
2011-09-07 19:36 ` Jarod Wilson
2011-09-08 2:43 ` Sandy Harris
2011-09-07 19:49 ` David Miller
2011-09-07 20:02 ` Steve Grubb
2011-09-07 20:23 ` Sasha Levin
2011-09-07 20:30 ` Steve Grubb
2011-09-07 20:37 ` Sasha Levin
2011-09-07 20:56 ` Steve Grubb
2011-09-07 21:10 ` Sasha Levin
2011-09-07 21:28 ` Steve Grubb
2011-09-07 21:38 ` Sasha Levin [this message]
2011-09-07 21:35 ` Jarod Wilson
2011-09-07 21:43 ` Steve Grubb
2011-09-07 22:46 ` Sven-Haegar Koch
2011-09-08 7:21 ` Sasha Levin
2011-09-07 23:57 ` Neil Horman
2011-09-08 6:41 ` Tomas Mraz
2011-09-08 12:52 ` Neil Horman
2011-09-08 13:11 ` Steve Grubb
2011-09-08 13:49 ` Neil Horman
2011-09-09 2:21 ` Sandy Harris
2011-09-09 13:04 ` Steve Grubb
2011-09-09 16:25 ` Ted Ts'o
2011-09-09 21:27 ` Thomas Gleixner
2011-09-12 13:56 ` Jarod Wilson
2011-09-13 10:58 ` Peter Zijlstra
2011-09-13 12:18 ` Jarod Wilson
2011-09-11 2:05 ` Valdis.Kletnieks
2011-09-12 13:55 ` Jarod Wilson
2011-09-12 16:58 ` Valdis.Kletnieks
2011-09-12 18:26 ` Jarod Wilson
2011-09-07 20:33 ` Neil Horman
2011-09-07 20:48 ` Steve Grubb
2011-09-07 21:18 ` Ted Ts'o
2011-09-07 21:27 ` Stephan Mueller
2011-09-07 21:27 ` Stephan Mueller
2011-09-07 21:38 ` Ted Ts'o
2011-09-08 8:44 ` Christoph Hellwig
2011-09-08 11:48 ` Steve Grubb
2011-09-08 16:13 ` David Miller
2011-09-09 19:08 ` Eric Paris
2011-09-09 19:12 ` Neil Horman
2011-09-08 8:42 ` Christoph Hellwig
2011-09-08 8:42 ` Christoph Hellwig
2011-09-07 21:20 ` Nikos Mavrogiannopoulos
2011-09-08 8:41 ` Christoph Hellwig
2011-09-12 14:02 ` Jarod Wilson
2011-09-12 14:02 ` Jarod Wilson
2011-09-12 14:58 ` Neil Horman
2011-09-12 17:06 ` Mark Brown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1315431511.3576.66.camel@lappy \
--to=levinsasha928@gmail.com \
--cc=herbert.xu@redhat.com \
--cc=jarod@redhat.com \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mpm@selenic.com \
--cc=nhorman@redhat.com \
--cc=sgrubb@redhat.com \
--cc=stephan.mueller@atsec.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.