| Summary: | app-shells/mksh likes to try to write to /dev/urandom | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Patrick Lauer <patrick> |
| Component: | New packages | Assignee: | Hanno Böck <hanno> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | gentoo, t.glaser |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Attachments: | Patch for arc4random.c.1.14 | ||
|
Description
Patrick Lauer
2010-03-06 09:11:02 UTC
Ok, I tracked this one down to a change I made yesterday, which makes pretty much all packages fail to emerge. I changed the /bin/sh symlink to /bin/mksh, which is app-shells/mksh Setting it back to /bin/bash "fixes" the build issues We used to have a SANDBOX_PREDICT for /dev/random (not urandom) in portage, but it's been removed since bug 258684. I don't see a corresponding entry in /etc/sandbox.conf from sandbox-2.2 though. Maybe we should do both random and urandom? dont write to /dev/urandom This is actually the arc4random.c.1.14 source file. Writes to /dev/urandom
are harmless, they’re denied if not root (sadly, except on Win32 and MirBSD,
there is no defined way to add entropy to the pool as non-root) anyway, and
if root, added into the pool in a way that doesn’t do harm. (I actually read
the implementation of /dev/*random.)
However, if you must prevent this by policy, remove the following lines from
the arc4random.c.1.14 file:
370 int fd;
371
372 if ((fd = open(__randomdev, O_WRONLY)) != -1) {
373 if (write(fd, buf, len) < 4)
374 do_rd = 1;
375 close(fd);
376 }
377 return (do_rd || fd == -1 ? 0 : 1);
Replace with:
return (0);
You should consider upgrading to arc4random.c.1.27 anyway (which
would need the same patch).
Created attachment 237117 [details, diff]
Patch for arc4random.c.1.14
Adding a patch for version 1.14 oof arc4random.c
I can verify that the attached patch works. What I did: 1.) emerge mksh-39c (from portage) 2.) Link /bin/sh to mksh 3.) emerge sys-devel/m4 => FAILS with messages "ACCESS DENIED open_wr: /dev/urandom" 4.) emerge mksh-39c-r1 (with patch) 5.) emerge sys-devel/m4 => WORKS without errors. Hanno, can you please include this patch into main tree? Thorsten, which improvements were made in arc4random.c.1.27 compared to 1.14? Diff: https://www.mirbsd.org/cvs.cgi/contrib/code/Snippets/arc4random.c.diff?r1=1.14;r2=1.27 CVSweb: https://www.mirbsd.org/cvs.cgi/contrib/code/Snippets/arc4random.c Hanno is not responding... Patrick, are you able to upload the attached patch to partage? mksh R40 will not use arc4random at all any more (at least not on systems other than OpenBSD-derived ones), since it’s sometimes too expensive, e.g. on Debian/m68k, as a speed-up. These OSes do ASLR anyway, which we can use to seed $RANDOM, it was never intended for crypto anyway and is only 15 bit output and 32 bit internal wide as well. There’s no plan when R40 will come out though, don’t hold your breath for it. + 11 Jul 2010; Patrick Lauer <patrick@gentoo.org> mksh-39c.ebuild, + +files/mksh-39c-urandom-write.patch: + Fix for #307983, thanks to Fabian Koester Danke! |