Re: [gentoo-hardened] ssp random bytes solution

[Ned Ludd]

On Mon, 2004-04-19 at 17:55, Robert Connolly wrote:
> Hello. I have attached two patches. The linux kernel patch is from Eli
> Billauer of http://frandom.sourceforge.net/ Full source and docs for this
> patch are here http://www.linuxfromscratch.org/~robert/hlfs/hints/
> attachments/entropy/frandom-0.8.tar.gz
>
> This version of frandom includes erandom (economical) which uses frandom as a
> seed, and uses no entropy from the kernel. The quality of the output bytes
> has been tested and found to be good quality random. Its not intended for
> crypto, its for anything else. This version of frandom also features a sysctl
> interface. The attached kernel patch enables it by default. It can be found
> in the char devices config menu.

Could you test the following attachment (guard-test) a few times and
post the results?  Mainly I'd like to verify that your __guard is infact
working as expected. (It should SEGFAULT or SIGABRT)

> The attached glibc patch uses the frandom sysctl interface, and has a bug fix
> (/4). I removed some #ifdefs that I thought should always be defined (maybe
> someone can double check it, should be okay though). So, install the frandom
> kernel first (built in, not module), reboot, and replace this attached glibc
> patch with the original glibc-ssp patch, and install glibc.
>

> The finished result will stop SSP from draining kernel entropy. Preformance
> might be a bit better then using /dev/urandom too. And sysctl will work threw
> chroot without depending on a device in /dev.
I like that.

> Comments, questions?

I took a quick look at the (glibc) code and it appears as if you drooped
support completely for /dec/urandom I'm not sure if that's a good idea
because if a user decides not to use frandom then she will end up with
the default canary only which would weaken the entire model..

Also can this be enabled in the kernel as non LKM? 
As handy as modules are they are a security risk and should be avoided
at all costs.

> I'm subscribed to this list, please don't cc me.
>
> Robert
>
> ______________________________________________________________________
> --
> gentoo-hardened@g.o mailing list

-- 
Ned Ludd <solar@g.o>
Gentoo Linux Developer