Re: [OE-core] [PATCH] openssl: add rdcpu to rand-seed

["Adrian Bunk" <bunk@stusta.de>]

On Fri, Jul 10, 2020 at 09:21:26PM +0100, Richard Purdie wrote:
> On Fri, 2020-07-10 at 12:39 -0700, Taras Kondratiuk via lists.openembedded.org wrote:
> > Native[sdk] openssl fails to initialize RNG on systems where native[sdk]
> > glibc is built against pre-3.17 linux-libc-headers, but runs on 4.8+
> > kernel:
> > 140737348333184:error:2406C06E:random number generator:RAND_DRBG_instantiate:error retrieving entropy:../openssl-1.1.1g/crypto/rand/drbg_lib.c:342
> > 
> > Commit 3ff98f558157 ("Start up DEVRANDOM entropy improvement for older
> > Linux devices.") in OpenSSL 1.1.1d has effectively disabled devrandom
> > seed source for kernels >=4.8. The assumption is that getrandom(2) will
> > be used instead. Getrandom syscall was added in kernel 3.17 by commit
> > c6e9d6f38894 ("random: introduce getrandom(2) system call"). So on a
> > system with 4.8+ kernel and pre-3.17 libc headers both getrandom and
> > devrandom can't be used.
> 
> Where would we find a system where we're building with pre-3.17 libc
> headers?
> 
> We updated to 3.17 in 2014:
>...

Native uses the host one.

In Yocto >= 3.1 old host distributions have to use the 
buildtools-extended tarball for unrelated reasons,
which should fix this problem.

Building Yocto <= 3.0 on Debian 8 (3.16 userspace headers) running the 
optional kernel 4.9 would match the reported problem.

Or building Yocto <= 3.0 in a chroot with an older distribution
on a system running a more recent kernel.

> Cheers,
> 
> Richard

cu
Adrian