3 ms·

You're correct :-) - it does periodically stir in new entropy. I'm fine with stirring in new entropy after chrooting - I just don't want to see sketchy entropy

by agwa 12y ago

You're correct :-) - it does periodically stir in new entropy. I'm fine with stirring in new entropy after chrooting - I just don't want to see sketchy entropy being used, especially for the initial entropy source. If you could make LibreSSL open (and keep open) /dev/urandom before you chroot, LibreSSL could read additional entropy from the already open file descriptor, even after chrooting. In any case, note that the chroot issue is a bit of a sideshow compared to the much more serious fork issue.

blahrf 12y ago
Not sure how a library is going to keep a caller from closing a descriptor - I've certainly seen people attempt to close them all in code before a fork, but that's probably pathological. However that doesn't work across a re-exec, which would also be good practice in many situations (ASLR) - so having to keep a descriptor open to do this would actually discourage secure programming practices because the library would screw you then. What's here will work in that case from the look of it. (assuming sysctl is there, or the voodoo isn't really that bad, I can't tell myself yet... still looking)
- agwa 12y ago
  Those are good points. Really, Linux needs a proper, non-deprecated, syscall for this.
- quotemstr 12y ago
  It's reasonable to require that an exec in a chroot have a minimal /dev. If you execute a program in a broken environment, it breaks. That shouldn't be surprising.
vidarh 12y ago
There are many potential cases where LibreSSL won't be initialized until after a chroot, by a program with no special rights running inside the chroot, that is entirely unable to open /dev/urandom or create a device node, so this is not a solution.