@@ -1001,7 +1001,7 @@ This is a directory, with the following entries:
* ``urandom_min_reseed_secs``: obsolete (used to determine the minimum
number of seconds between urandom pool reseeding). This file is
writable for compatibility purposes, but writing to it has no effect
- on any RNG behavior.
+ on any RNG behavior;
* ``uuid``: a UUID generated every time this is retrieved (this can
thus be used to generate UUIDs at will);
@@ -1009,8 +1009,10 @@ This is a directory, with the following entries:
* ``write_wakeup_threshold``: when the entropy count drops below this
(as a number of bits), processes waiting to write to ``/dev/random``
are woken up. This file is writable for compatibility purposes, but
- writing to it has no effect on any RNG behavior.
+ writing to it has no effect on any RNG behavior;
+* ``fork_event``: unreadable, but can be poll()'d on for notifications
+ delivered after the RNG reseeds following a virtual machine fork.
randomize_va_space
==================
@@ -1187,6 +1187,9 @@ EXPORT_SYMBOL_GPL(add_bootloader_randomness);
#if IS_ENABLED(CONFIG_VMGENID)
static BLOCKING_NOTIFIER_HEAD(vmfork_chain);
+#ifdef CONFIG_SYSCTL
+static DEFINE_CTL_TABLE_POLL(sysctl_fork_event_poll);
+#endif
/*
* Handle a new unique VM ID, which is unique, not secret, so we
@@ -1201,6 +1204,9 @@ void add_vmfork_randomness(const void *unique_vm_id, size_t size)
pr_notice("crng reseeded due to virtual machine fork\n");
}
blocking_notifier_call_chain(&vmfork_chain, 0, NULL);
+#ifdef CONFIG_SYSCTL
+ proc_sys_poll_notify(&sysctl_fork_event_poll);
+#endif
}
#if IS_MODULE(CONFIG_VMGENID)
EXPORT_SYMBOL_GPL(add_vmfork_randomness);
@@ -1655,6 +1661,8 @@ const struct file_operations urandom_fops = {
* It is writable to avoid breaking old userspaces, but writing
* to it does not change any behavior of the RNG.
*
+ * - fork_event - an unreadable file that can be poll()'d on for VM forks.
+ *
********************************************************************/
#ifdef CONFIG_SYSCTL
@@ -1708,6 +1716,14 @@ static int proc_do_rointvec(struct ctl_table *table, int write, void *buffer,
return write ? 0 : proc_dointvec(table, 0, buffer, lenp, ppos);
}
+#if IS_ENABLED(CONFIG_VMGENID)
+static int proc_do_nodata(struct ctl_table *table, int write, void *buffer,
+ size_t *lenp, loff_t *ppos)
+{
+ return -ENODATA;
+}
+#endif
+
static struct ctl_table random_table[] = {
{
.procname = "poolsize",
@@ -1748,6 +1764,14 @@ static struct ctl_table random_table[] = {
.mode = 0444,
.proc_handler = proc_do_uuid,
},
+#if IS_ENABLED(CONFIG_VMGENID)
+ {
+ .procname = "fork_event",
+ .mode = 0444,
+ .poll = &sysctl_fork_event_poll,
+ .proc_handler = proc_do_nodata,
+ },
+#endif
{ }
};
In order to inform userspace of virtual machine forks, this commit adds a "fork_event" sysctl, which does not return any data, but allows userspace processes to poll() on it for notification of VM forks. It avoids exposing the actual vmgenid from the hypervisor to userspace, in case there is any randomness value in keeping it secret. Rather, userspace is expected to simply use getrandom() if it wants a fresh value. For example, the following snippet can be used to print a message every time a VM forks, after the RNG has been reseeded: struct pollfd fd = { .fd = open("/proc/sys/kernel/random/fork_event", O_RDONLY) }; assert(fd.fd >= 0); for (;;) { assert(poll(&fd, 1, -1) > 0); puts("vm fork detected"); } Various programs and libraries that utilize cryptographic operations depending on fresh randomness can invalidate old keys or take other appropriate actions when receiving that event. While this is racier than allowing userspace to mmap/vDSO the vmgenid itself, it's an incremental step forward that's not as heavyweight. Cc: Dominik Brodowski <linux@dominikbrodowski.net> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Theodore Ts'o <tytso@mit.edu> Cc: Alexander Graf <graf@amazon.com> Cc: Jann Horn <jannh@google.com> Cc: Colm MacCarthaigh <colmmacc@amazon.com> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> --- Alex/Colm - Could you guys let me know if this satisfies what you'd need it for at Amazon? Changes v1->v2: - Some small fixes with the CONFIG_SYSCTL ifdef. Documentation/admin-guide/sysctl/kernel.rst | 6 ++++-- drivers/char/random.c | 24 +++++++++++++++++++++ 2 files changed, 28 insertions(+), 2 deletions(-)