<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 15, 2016 at 6:47 PM, Eric Blake <span dir="ltr"><<a href="mailto:eblake@redhat.com" target="_blank">eblake@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 04/15/2016 04:41 AM, Cole Robinson wrote:<br>
> Libvirt currently rejects using host /dev/urandom as an input source for a<br>
> virtio-rng device. The only accepted sources are /dev/random and /dev/hwrng.<br>
> This is the result of discussions on qemu-devel around when the feature was<br>
> first added (2013). Examples:<br>
><br>
> <a href="http://lists.gnu.org/archive/html/qemu-devel/2012-09/msg02387.html" rel="noreferrer" target="_blank">http://lists.gnu.org/archive/html/qemu-devel/2012-09/msg02387.html</a><br>
> <a href="https://lists.gnu.org/archive/html/qemu-devel/2013-03/threads.html#00023" rel="noreferrer" target="_blank">https://lists.gnu.org/archive/html/qemu-devel/2013-03/threads.html#00023</a><br>
><br>
> libvirt's rejection of /dev/urandom has generated some complaints from users:<br>
><br>
> <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1074464" rel="noreferrer" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=1074464</a><br>
> * cited: <a href="http://www.2uo.de/myths-about-urandom/" rel="noreferrer" target="_blank">http://www.2uo.de/myths-about-urandom/</a><br>
> <a href="http://www.redhat.com/archives/libvir-list/2016-March/msg01062.html" rel="noreferrer" target="_blank">http://www.redhat.com/archives/libvir-list/2016-March/msg01062.html</a><br>
> <a href="http://www.redhat.com/archives/libvir-list/2016-April/msg00186.html" rel="noreferrer" target="_blank">http://www.redhat.com/archives/libvir-list/2016-April/msg00186.html</a><br>
><br>
> I think it's worth having another discussion about this, at least with a<br>
> recent argument in one place so we can put it to bed. I'm CCing a bunch of<br>
> people. I think the questions are:<br>
><br>
> 1) is the original recommendation to never use virtio-rng+/dev/urandom correct?<br>
<br>
</span>That I'm not sure about - and the answer may be context-dependent (for<br>
example a FIPS user may care more than an ordinary user)<br>
<span class=""><br>
><br>
> 2) regardless of #1, should we continue to reject that config in libvirt?<br>
<br>
</span>This one, I have a pretty strong opinion: libvirt should NOT enforce<br>
policy. If someone has a valid use case for doing it, we should permit<br>
them to do it, even if it lets someone else shoot themselves in the<br>
foot. So I think we should relax libvirt to allow users that source<br>
their virtio-rng from /dev/urandom.<br></blockquote><div><br></div><div>+1 </div><div>I'd personally be happy (for some specific test-dev use case) with /dev/zero - I don't care about the security, but I want the entropy collection to be done as fast as possible.</div><div>Y.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Eric Blake eblake redhat com <a href="tel:%2B1-919-301-3266" value="+19193013266">+1-919-301-3266</a><br>
Libvirt virtualization library <a href="http://libvirt.org" rel="noreferrer" target="_blank">http://libvirt.org</a><br>
<br>
</font></span><br>--<br>
libvir-list mailing list<br>
<a href="mailto:libvir-list@redhat.com">libvir-list@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/libvir-list" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/libvir-list</a><br></blockquote></div><br></div></div>