From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.3 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1D3AC4CEC9 for ; Tue, 17 Sep 2019 16:22:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 793F520665 for ; Tue, 17 Sep 2019 16:22:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727152AbfIQQWM (ORCPT ); Tue, 17 Sep 2019 12:22:12 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:47109 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726741AbfIQQWM (ORCPT ); Tue, 17 Sep 2019 12:22:12 -0400 Received: (from willy@localhost) by pcw.home.local (8.15.2/8.15.2/Submit) id x8HGLboc027929; Tue, 17 Sep 2019 18:21:37 +0200 Date: Tue, 17 Sep 2019 18:21:37 +0200 From: Willy Tarreau To: Lennart Poettering Cc: "Theodore Y. Ts'o" , Matthew Garrett , Linus Torvalds , "Ahmed S. Darwish" , Vito Caputo , Andreas Dilger , Jan Kara , Ray Strode , William Jon McCann , "Alexander E. Patrakov" , zhangjs , linux-ext4@vger.kernel.org, lkml Subject: Re: Linux 5.3-rc8 Message-ID: <20190917162137.GA27921@1wt.eu> References: <20190917052438.GA26923@1wt.eu> <2508489.jOnZlRuxVn@merkaba> <20190917121156.GC6762@mit.edu> <20190917155743.GB31567@gardel-login> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190917155743.GB31567@gardel-login> User-Agent: Mutt/1.6.1 (2016-04-27) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Sep 17, 2019 at 05:57:43PM +0200, Lennart Poettering wrote: > Note that calling getrandom(0) "too early" is not something people do > on purpose. It happens by accident, i.e. because we live in a world > where SSH or HTTPS or so is run in the initrd already, and in a world > where booting sometimes can be very very fast. It's not an accident, it's a lack of understanding of the impacts from the people who package the systems. Generating an SSH key from an initramfs without thinking where the randomness used for this could come from is not accidental, it's a lack of experience that will be fixed once they start to collect such reports. And those who absolutely need their SSH daemon or HTTPS server for a recovery image in initramfs can very well feed fake entropy by dumping whatever they want into /dev/random to make it possible to build temporary keys for use within this single session. At least all supposedly incorrect use will be made *on purpose* and will still be possible to match what users need. > So even if you write a > program and you think "this stuff should run late I'll just > getrandom(0)" it might not actually be that case IRL because people > deploy it a slightly bit differently than you initially thought in a > slightly differently equipped system with other runtime behaviour... I agree with this, it's precisely because I think we should not restrict userspace capabilities that I want the issue addressed in a way that lets users do what they need instead of relying on dangerous workarounds. Just googling for "mknod /dev/random c 1 9" returns tens, maybe hundreds of pages all explaining how to fix the problem of non-booting systems. It simply proves that the kernel is not the place to decide what users are allowed to do. Let's give them the tools to work correctly and be responsible for their choices. They just need to be hit by bad choices to get some feedback from the field other than a new list of well-known SSH keys. Willy