From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:35991) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SWYLg-0001rp-SB for qemu-devel@nongnu.org; Mon, 21 May 2012 15:32:58 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SWYLe-00008N-Qj for qemu-devel@nongnu.org; Mon, 21 May 2012 15:32:56 -0400 Received: from mx1.redhat.com ([209.132.183.28]:7222) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SWYLe-000084-IC for qemu-devel@nongnu.org; Mon, 21 May 2012 15:32:54 -0400 Date: Tue, 22 May 2012 01:02:22 +0530 From: Amit Shah Message-ID: <20120521193130.GB14541@amit.redhat.com> References: <4FB3AA86.3080507@codemonkey.ws> <20120516134534.GK22979@redhat.com> <4FB3B024.8020600@codemonkey.ws> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4FB3B024.8020600@codemonkey.ws> Subject: Re: [Qemu-devel] [PATCH 1/1] virtio-rng: device to send host entropy to guest List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: qemu list On (Wed) 16 May 2012 [08:48:20], Anthony Liguori wrote: > On 05/16/2012 08:45 AM, Daniel P. Berrange wrote: > >On Wed, May 16, 2012 at 08:24:22AM -0500, Anthony Liguori wrote: > >>On 05/16/2012 06:30 AM, Amit Shah wrote: > >>>The Linux kernel already has a virtio-rng driver, this is the device > >>>implementation. > >>> > >>>When Linux needs more entropy, it puts a buffer in the vq. We then put > >>>entropy into that buffer, and push it back to the guest. > >>> > >>>Feeding randomness from host's /dev/urandom into the guest is > >>>sufficient, so this is a simple implementation that opens /dev/urandom > >>>and reads from it whenever required. > >>> > >>>Invocation is simple: > >>> > >>> qemu ... -device virtio-rng-pci > >>> > >>>In the guest, we see > >>> > >>> $ cat /sys/devices/virtual/misc/hw_random/rng_available > >>> virtio > >>> > >>> $ cat /sys/devices/virtual/misc/hw_random/rng_current > >>> virtio > >>> > >>>There are ways to extend the device to be more generic and collect > >>>entropy from other sources, but this is simple enough and works for now. > >>> > >>>Signed-off-by: Amit Shah > >> > >>It's not this simple unfortunately. > >> > >>If you did this with libvirt, one guest could exhaust the available > >>entropy for the remaining guests. This could be used as a mechanism > >>for one guest to attack another (reducing the available entropy for > >>key generation). > >> > >>You need to rate limit the amount of entropy that a guest can obtain > >>to allow management tools to mitigate this attack. > > > >Ultimately I think you need to have a push mechanism, where an external > >process feeds entropy to QEMU, rather than a pull mechanism where QEMU > >grabs entropy itself. > > A previous patch didn't open urandom directly but instead talked to > an entropy daemon. This approach would allow libvirt to hand out > entropy as it saw fit without requiring a new driver. Using egd isn't necessary -- libvirt could still read urandom and pass on to qemu at configured intervals. Amit