Subject: Re: [PATCH v9 2/3] fdt: add support for rng-seed

From: Kees Cook <[email-masked]>
Date: Thu, 29 Aug 2019 09:25:32 -0700

On Thu, Aug 29, 2019 at 11:45:05AM -0400, Theodore Y. Ts'o wrote:
> I thought about asking for this, but we really want to do this as
> early as possible, so that it can be used by KASLR and other services

KASLR entropy is sent via a separate DT entry, since it's needed before
the kernel is even running.

> that are run super early.  Also, whether or not we can trust the

Are there things using the kernel RNG before the stack canary is set up?
I tried to move all of that code as early as possible already.

> bootloader is going to be a system-level thing.  This should probably
> be defaulted to off, and only enabled by the system integrator if they
> are 100%, positively sure, that the entire system is one where we can
> trust the source of randomness which the bootloader is using --- or
> for that matter, that the bootloader is trustworthy!
> 
> Is it really going to be that useful for a random system administrator
> to be able to flip this on or off from the command line?  Hopefully
> there will be an easy way to configure the firmware or the bootloader
> to simply not supply entropy, if for some reason it's not trustworthy.

You have a point about bootloader vs system design. I'm cautiously
convinced we don't need a boot param, but if we CAN put all the entropy
collection in a single place, that'd be nice.

-- 
Kees Cook

_______________________________________________
linux-arm-kernel mailing list
[email-masked]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel