On Fri, Apr 15, 2016 at 6:47 PM, Eric Blake <ebl...@redhat.com> wrote:
> On 04/15/2016 04:41 AM, Cole Robinson wrote: > > Libvirt currently rejects using host /dev/urandom as an input source for > a > > virtio-rng device. The only accepted sources are /dev/random and > /dev/hwrng. > > This is the result of discussions on qemu-devel around when the feature > was > > first added (2013). Examples: > > > > http://lists.gnu.org/archive/html/qemu-devel/2012-09/msg02387.html > > https://lists.gnu.org/archive/html/qemu-devel/2013-03/threads.html#00023 > > > > libvirt's rejection of /dev/urandom has generated some complaints from > users: > > > > https://bugzilla.redhat.com/show_bug.cgi?id=1074464 > > * cited: http://www.2uo.de/myths-about-urandom/ > > http://www.redhat.com/archives/libvir-list/2016-March/msg01062.html > > http://www.redhat.com/archives/libvir-list/2016-April/msg00186.html > > > > I think it's worth having another discussion about this, at least with a > > recent argument in one place so we can put it to bed. I'm CCing a bunch > of > > people. I think the questions are: > > > > 1) is the original recommendation to never use virtio-rng+/dev/urandom > correct? > > That I'm not sure about - and the answer may be context-dependent (for > example a FIPS user may care more than an ordinary user) > > > > > 2) regardless of #1, should we continue to reject that config in libvirt? > > This one, I have a pretty strong opinion: libvirt should NOT enforce > policy. If someone has a valid use case for doing it, we should permit > them to do it, even if it lets someone else shoot themselves in the > foot. So I think we should relax libvirt to allow users that source > their virtio-rng from /dev/urandom. > +1 I'd personally be happy (for some specific test-dev use case) with /dev/zero - I don't care about the security, but I want the entropy collection to be done as fast as possible. Y. > > -- > Eric Blake eblake redhat com +1-919-301-3266 > Libvirt virtualization library http://libvirt.org > > > -- > libvir-list mailing list > libvir-list@redhat.com > https://www.redhat.com/mailman/listinfo/libvir-list >
-- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list