Re: Re: magic constants in some startup code

[Rich Felker <dalias@libc.org>]

On Fri, Oct 31, 2014 at 02:29:32PM -0700, Andy Lutomirski wrote:
> >> For example, musl could implement a trivial DRBG seeded by AT_RANDOM and
> >> replace the AT_RANDOM data with the first output from the DRBG at
> >> startup.  Then getauxval users are safe and musl can also have a stream
> >> of decent random numbers for internal use.
> > 
> > This imposes a large code size cost in the mandatory startup code even
> > on programs that have no interest in AT_RANDOM (99% or more). Instead,
> > the first call to getauxval could do this, though, but I'm not sure
> > it's a good approach anyway. Linux has added the getrandom syscall
> > which can provide the BSD getentropy function or the more featureful
> > getrandom API, so using getauxval(AT_RANDOM) seems like a bad idea.
> > Even if we avoided reuse of the same data that went into the canary,
> > there's no way for callers using getauxval(AT_RANDOM) to tell whether
> > some other library code in the same process has already consumed
> > entropy from AT_RANDOM, so using it is not library-safe. It seems like
> > we should try to discourage use of getauxval(AT_RANDOM) as an entropy
> > source rather than giving false hope that it's safe.
> 
> getrandom(2) has the annoying problem that you can't ask it for
> best-effort entropy.  This caused systemd to add a /dev/urandom fallback
> a few days ago (sigh).

Is best-effort ever useful? My feeling is that either you need
cryptographic quality entropy, in which case it's not acceptable to
get something fake, or you don't, in which case you can use something
like the clock. Maybe I'm misunderstanding what you mean by
best-effort. My impression was that getrandom was equivalent to
/dev/urandom, not the tin-foil-hattery that is /dev/random.

> Maybe I'll try to get a GRND_BESTEFFORT flag for getrandom into the
> kernel.  I suppose that a musl getrandom wrapper could emulate that flag
> (only) or something on older kernels.  Or maybe glibc and musl could
> both agree to add some get_sort_of_decent_entropy function based on
> AT_RANDOM.

Really you can provide perfecty good random numbers for cryptographic
purposes with just AT_RANDOM as a seen and a proper csprng. My
understanding of the motivation for fancier stuff is a (misguided,
IMO) idea that sequences in the parent and child should be independent
after fork.

> >> If you think this is a good idea, I could implement it.  The main
> >> downside would be that it'll require some crypto primitive.  There's
> >> already a SHA-256 implementation in musl that could be reused, but it
> >> would be a bit unfortunate to pull it in to all musl-linked static binaries.
> > 
> > Yes, code size is a concern, but it could be tucked away as a
> > dependency of other functions instead of being a dependency of the
> > startup code.
> 
> Most or all existing getauxval users are unlikely to be using AT_RANDOM,
> so doing this without any bloat might be hard.

Yes, this is a good point.

Rich