On Thu, Jul 05, 2012 at 07:49:42AM -0400, John Baldwin wrote: > On Wednesday, July 04, 2012 4:45:54 pm Attilio Rao wrote: > > 2012/7/4 David Chisnall <thera...@freebsd.org>: > > > On 4 Jul 2012, at 21:32, Andrey Chernov wrote: > > > > > >> 1) /dev/urandom may not exist in jails/sandboxes while sysctls (or old > way > > >> initialization) always exists. > > > > > > From the perspective of Capsicum sandboxes, a device node is better than > > > a > sysctl. The kernel must hard-code policy about which sysctls are permitted, > but access to file descriptors is decided on a per-sandbox basis and is > configurable by the user. The same applies to jails, although it's slightly > more effort to make device nodes appear inside a jail. > > > > Also don't understimate the locking factor here. > > I recall that at some point /dev/random was introducing some > > scalability penalty on php (maybe related to the suhosin patch) until > > kib made shared lookups available on devfs. IIRC, sysctls are still > > Giant locked. > > sysctls are not all Giant locked. KERN_ARND is marked MPSAFE, so it does > not > use Giant:
It doesn't really matter. Our in-kernel random generator has its own
giant lock, so is basically single threaded. Compare results of those
two on some SMP machine:
# dd if=/dev/random of=/dev/null bs=1m count=1024
# sh -c 'for i in `jot $(sysctl -n hw.ncpu)`; do dd if=/dev/random
of=/dev/null bs=1m count=128 & done'
--
Pawel Jakub Dawidek http://www.wheelsystems.com
FreeBSD committer http://www.FreeBSD.org
Am I Evil? Yes, I Am! http://tupytaj.pl
pgpYXjRJtb7cq.pgp
Description: PGP signature
