From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8D67BC4CECD for ; Tue, 17 Sep 2019 16:08:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6D9E3214AF for ; Tue, 17 Sep 2019 16:08:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728987AbfIQQIq (ORCPT ); Tue, 17 Sep 2019 12:08:46 -0400 Received: from gardel.0pointer.net ([85.214.157.71]:40620 "EHLO gardel.0pointer.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726857AbfIQQIq (ORCPT ); Tue, 17 Sep 2019 12:08:46 -0400 Received: from gardel-login.0pointer.net (gardel.0pointer.net [IPv6:2a01:238:43ed:c300:10c3:bcf3:3266:da74]) by gardel.0pointer.net (Postfix) with ESMTP id B3788E80FFC; Tue, 17 Sep 2019 18:08:44 +0200 (CEST) Received: by gardel-login.0pointer.net (Postfix, from userid 1000) id 6D90D160ADC; Tue, 17 Sep 2019 18:08:44 +0200 (CEST) Date: Tue, 17 Sep 2019 18:08:44 +0200 From: Lennart Poettering To: "Ahmed S. Darwish" Cc: "Theodore Y. Ts'o" , Willy Tarreau , Matthew Garrett , Linus Torvalds , Vito Caputo , Andreas Dilger , Jan Kara , Ray Strode , William Jon McCann , "Alexander E. Patrakov" , zhangjs , linux-ext4@vger.kernel.org, lkml Subject: Re: Linux 5.3-rc8 Message-ID: <20190917160844.GC31567@gardel-login> References: <20190917052438.GA26923@1wt.eu> <2508489.jOnZlRuxVn@merkaba> <20190917121156.GC6762@mit.edu> <20190917123015.sirlkvy335crozmj@debian-stretch-darwi.lab.linutronix.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190917123015.sirlkvy335crozmj@debian-stretch-darwi.lab.linutronix.de> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Di, 17.09.19 12:30, Ahmed S. Darwish (darwish.07@gmail.com) wrote: > Ideally, systems would be configured with hardware random > number generators, and/or configured to trust the CPU-provided > RNG's (CONFIG_RANDOM_TRUST_CPU) or boot-loader provided ones > (CONFIG_RANDOM_TRUST_BOOTLOADER). In addition, userspace > should generate cryptographic keys only as late as possible, > when they are needed, instead of during early boot. (For > non-cryptographic use cases, such as dictionary seeds or MIT > Magic Cookies, other mechanisms such as /dev/urandom or > random(3) may be more appropropriate.) > > Sounds good? This sounds mean. You make apps pay for something they aren't really at fault for. I mean, in the cloud people typically put together images that are replicated to many systems, and as first thing generate an SSH key, on the individual system. In fact, most big distros tend to ship SSH that is precisely set up this way: on first boot the SSH key is generated. They tend to call getrandom(0) for this right now, and rightfully so. Now suddenly you kill them because they are doing everything correctly? Those systems aren't going to be more useful if they have no SSH key at all than they would be if they would hang at boot: either way you can't log in. Here's what I'd propose: 1) Add GRND_INSECURE to get those users of getrandom() who do not need high quality entropy off its use (systemd has uses for this, for seeding hash tables for example), thus reducing the places where things might block. 2) Add a kernel log message if a getrandom(0) client hung for 15s or more, explaining the situation briefly, but not otherwise changing behaviour. 3) Change systemd-random-seed.service to log to console in the same case, blocking boot cleanly and discoverably. I am not a fan of randomly killing userspace processes that just happened to be the unlucky ones, to call this first... I see no benefit in killing stuff over letting boot hang in a discoverable way. Lennart