Module Name: src
Committed By: riastradh
Date: Wed Aug 28 14:08:48 UTC 2024
Modified Files:
src/lib/libc/gen: getentropy.3
Log Message:
getentropy(3): Note intent to reseed on VM clone, and caveats.
Tidy markup and pacify some mandoc -Tlint complaints while here.
PR kern/58632: getentropy(2) and arc4random(3) do not reseed on VM
fork
To generate a diff of this commit:
cvs rdiff -u -r1.7 -r1.8 src/lib/libc/gen/getentropy.3
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/lib/libc/gen/getentropy.3
diff -u src/lib/libc/gen/getentropy.3:1.7 src/lib/libc/gen/getentropy.3:1.8
--- src/lib/libc/gen/getentropy.3:1.7 Thu Aug 15 23:44:49 2024
+++ src/lib/libc/gen/getentropy.3 Wed Aug 28 14:08:48 2024
@@ -1,4 +1,4 @@
-.\" $NetBSD: getentropy.3,v 1.7 2024/08/15 23:44:49 riastradh Exp $ $
+.\" $NetBSD: getentropy.3,v 1.8 2024/08/28 14:08:48 riastradh Exp $ $
.\"
.\" Copyright (c) 2020 The NetBSD Foundation, Inc.
.\" All rights reserved.
@@ -27,7 +27,7 @@
.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
.\" POSSIBILITY OF SUCH DAMAGE.
.\"
-.Dd February 28, 2023
+.Dd August 28, 2024
.Dt GETENTROPY 3
.Os
.Sh NAME
@@ -41,9 +41,8 @@
.Fn getentropy "void *buf" "size_t buflen"
.In limits.h
.Pp
-.Li #define GETENTROPY_MAX 256
+.Li #define GETENTROPY_MAX 256
.Sh DESCRIPTION
-.Pp
The
.Nm
function fills
@@ -99,6 +98,21 @@ However, the
interface alone can make no security guarantees without a physical
system configuration that includes random number generation hardware or
secret seed material from such hardware on another machine.
+.Pp
+.Nx
+attempts to reseed the system entropy pool when it has detected the
+system has been cloned as a guest in a virtual machine, so that
+subsequent calls to
+.Nm
+in the clones yield independent outputs.
+However, this relies on the virtual machine host to notify the guest,
+e.g. through the
+.Xr acpivmgenid 4
+device, and even so there is an unavoidable small window of time
+between when the virtual machine is actually cloned and when the system
+is reseeded during which
+.Nm
+may yield identical outputs in the clones.
.Sh SEE ALSO
.Xr arc4random 3 ,
.Xr rnd 4 ,
