Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 23 Mar 2022 00:30:14 -0400
From:   "Alex Xu (Hello71)" <alex_y_xu@yahoo.ca>
Subject: Re: [PATCH] random: allow writes to /dev/urandom to influence fast
 init
To:     "Jason A. Donenfeld" <Jason@zx2c4.com>,
        linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org
Cc:     Jann Horn <jannh@google.com>,
        Dominik Brodowski <linux@dominikbrodowski.net>,
        Guenter Roeck <linux@roeck-us.net>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Theodore Ts'o <tytso@mit.edu>
References: <20220322191436.110963-1-Jason@zx2c4.com>
In-Reply-To: <20220322191436.110963-1-Jason@zx2c4.com>
MIME-Version: 1.0
Message-Id: <1648009787.fah6dos6ya.none@localhost>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

I searched for users of RNDADDTOENTCNT using=20
(?s:ioctl.{1,500}RNDADDTOENTCNT) on Debian Code Search and=20
"/(?s)ioctl.{1,40},\s*RNDADDTOENTCNT/ -path:incfs_test.c" on GitHub Code=20
Search (beta).

Several programs use it for testing purposes, without writing any=20
entropy to /dev/random or /dev/urandom, including rauc, wireguard, and=20
openSUSE kdump. Several programs use it as intended, after writing=20
entropy to /dev/random or /dev/urandom. Of the latter group,

- kata-containers is a lightweight VM implementation. Its guest-side=20
  agent offers a gRPC endpoint which will write the provided data to=20
  /dev/random, then call RNDADDTOENTCNT with the length of the data,=20
  then call RNDRESEEDRNG. As far as I can tell, this endpoint is=20
  made available to users on the host, but is not used by=20
  kata-containers itself.

- aws-nitro-enclaves-sdk-c is an SDK for building lightweight VMs to be=20
  used with AWS Nitro Enclaves. kmstool-enclave is a sample application=20
  provided, which writes "up to 256 bytes" (from where?) to /dev/random,=20
  then calls RNDADDTOENTCNT, then repeats the process until it reaches=20
  1024 bytes.

- sandy-harris/maxwell is a "jitter entropy" daemon, similar to haveged.=20
  It writes 4 bytes of "generated entropy" to /dev/random, then calls=20
  RNDADDTOENTCNT, then repeats.

- guix is, among other things, a "GNU/"Linux distribution. The provided=20
  base services write the seed file to /dev/urandom, then call=20
  RNDADDTOENTCNT, then write 512 bytes from /dev/hwrng to /dev/urandom,=20
  then call RNDADDTOENTCNT, then "immediately" read 512 bytes from=20
  /dev/urandom and write it to the seed file. On shutdown, 512 bytes are=20
  read from /dev/urandom and written to the seed file.

I was unable to locate any other public non-archived usages of=20
RNDADDTOENTCNT on Debian or GitHub Code Search.

I don't have any particular expertise with the random subsystem or=20
conclusions to make from this data, but I hope this helps inform the=20
discussion.

Cheers,
Alex.