* [d-kernel] [PATCH un-def/sisyphus] config: Enable seeding CRNG from CPU and bootleader
@ 2022-05-09 14:23 Vitaly Chikunov
2022-05-09 16:05 ` Andrey Savchenko
0 siblings, 1 reply; 4+ messages in thread
From: Vitaly Chikunov @ 2022-05-09 14:23 UTC (permalink / raw)
To: devel-kernel
This can be disabled at boot time with:
random.trust_cpu=off
random.trust_bootloader=off
Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
---
config | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/config b/config
index e529911fd5dc..5b817e945274 100644
--- a/config
+++ b/config
@@ -4479,8 +4479,8 @@ CONFIG_XILLYBUS_CLASS=m
CONFIG_XILLYBUS=m
CONFIG_XILLYBUS_PCIE=m
# CONFIG_XILLYUSB is not set
-# CONFIG_RANDOM_TRUST_CPU is not set
-# CONFIG_RANDOM_TRUST_BOOTLOADER is not set
+CONFIG_RANDOM_TRUST_CPU=y
+CONFIG_RANDOM_TRUST_BOOTLOADER=y
# end of Character devices
#
--
2.33.2
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [d-kernel] [PATCH un-def/sisyphus] config: Enable seeding CRNG from CPU and bootleader
2022-05-09 14:23 [d-kernel] [PATCH un-def/sisyphus] config: Enable seeding CRNG from CPU and bootleader Vitaly Chikunov
@ 2022-05-09 16:05 ` Andrey Savchenko
2022-05-10 21:43 ` Vladimir D. Seleznev
0 siblings, 1 reply; 4+ messages in thread
From: Andrey Savchenko @ 2022-05-09 16:05 UTC (permalink / raw)
To: ALT Linux kernel packages development
[-- Attachment #1: Type: text/plain, Size: 833 bytes --]
On Mon, 9 May 2022 17:23:00 +0300 Vitaly Chikunov wrote:
> This can be disabled at boot time with:
> random.trust_cpu=off
> random.trust_bootloader=off
>
> Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
> ---
> config | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/config b/config
> index e529911fd5dc..5b817e945274 100644
> --- a/config
> +++ b/config
> @@ -4479,8 +4479,8 @@ CONFIG_XILLYBUS_CLASS=m
> CONFIG_XILLYBUS=m
> CONFIG_XILLYBUS_PCIE=m
> # CONFIG_XILLYUSB is not set
> -# CONFIG_RANDOM_TRUST_CPU is not set
> -# CONFIG_RANDOM_TRUST_BOOTLOADER is not set
> +CONFIG_RANDOM_TRUST_CPU=y
> +CONFIG_RANDOM_TRUST_BOOTLOADER=y
These sources are not trusted in most cases, so please avoid
enabling them by default for everyone.
Best regards,
Andrew Savchenko
[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [d-kernel] [PATCH un-def/sisyphus] config: Enable seeding CRNG from CPU and bootleader
2022-05-09 16:05 ` Andrey Savchenko
@ 2022-05-10 21:43 ` Vladimir D. Seleznev
2022-05-11 6:01 ` Andrey Savchenko
0 siblings, 1 reply; 4+ messages in thread
From: Vladimir D. Seleznev @ 2022-05-10 21:43 UTC (permalink / raw)
To: ALT Linux kernel packages development
On Mon, May 09, 2022 at 07:05:01PM +0300, Andrey Savchenko wrote:
> On Mon, 9 May 2022 17:23:00 +0300 Vitaly Chikunov wrote:
> > This can be disabled at boot time with:
> > random.trust_cpu=off
> > random.trust_bootloader=off
> >
> > Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
> > ---
> > config | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/config b/config
> > index e529911fd5dc..5b817e945274 100644
> > --- a/config
> > +++ b/config
> > @@ -4479,8 +4479,8 @@ CONFIG_XILLYBUS_CLASS=m
> > CONFIG_XILLYBUS=m
> > CONFIG_XILLYBUS_PCIE=m
> > # CONFIG_XILLYUSB is not set
> > -# CONFIG_RANDOM_TRUST_CPU is not set
> > -# CONFIG_RANDOM_TRUST_BOOTLOADER is not set
> > +CONFIG_RANDOM_TRUST_CPU=y
> > +CONFIG_RANDOM_TRUST_BOOTLOADER=y
>
> These sources are not trusted in most cases, so please avoid
> enabling them by default for everyone.
It's a very horrible world where you cannot trust to your CPU.
--
WBR,
Vladimir D. Seleznev
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [d-kernel] [PATCH un-def/sisyphus] config: Enable seeding CRNG from CPU and bootleader
2022-05-10 21:43 ` Vladimir D. Seleznev
@ 2022-05-11 6:01 ` Andrey Savchenko
0 siblings, 0 replies; 4+ messages in thread
From: Andrey Savchenko @ 2022-05-11 6:01 UTC (permalink / raw)
To: ALT Linux kernel packages development
[-- Attachment #1: Type: text/plain, Size: 1478 bytes --]
On Wed, 11 May 2022 00:43:37 +0300 Vladimir D. Seleznev wrote:
> On Mon, May 09, 2022 at 07:05:01PM +0300, Andrey Savchenko wrote:
> > On Mon, 9 May 2022 17:23:00 +0300 Vitaly Chikunov wrote:
> > > This can be disabled at boot time with:
> > > random.trust_cpu=off
> > > random.trust_bootloader=off
> > >
> > > Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
> > > ---
> > > config | 4 ++--
> > > 1 file changed, 2 insertions(+), 2 deletions(-)
> > >
> > > diff --git a/config b/config
> > > index e529911fd5dc..5b817e945274 100644
> > > --- a/config
> > > +++ b/config
> > > @@ -4479,8 +4479,8 @@ CONFIG_XILLYBUS_CLASS=m
> > > CONFIG_XILLYBUS=m
> > > CONFIG_XILLYBUS_PCIE=m
> > > # CONFIG_XILLYUSB is not set
> > > -# CONFIG_RANDOM_TRUST_CPU is not set
> > > -# CONFIG_RANDOM_TRUST_BOOTLOADER is not set
> > > +CONFIG_RANDOM_TRUST_CPU=y
> > > +CONFIG_RANDOM_TRUST_BOOTLOADER=y
> >
> > These sources are not trusted in most cases, so please avoid
> > enabling them by default for everyone.
>
> It's a very horrible world where you cannot trust to your CPU.
The concept of trust is not binary. I do not trust RDRAND for
sensitive materials. Even more so I do not trust UEFI platform
generators. E.g. see:
https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-destroyed-my-weekend/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0543
Welcome to the real world.
Best regards,
Andrew Savchenko
[-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-05-11 6:01 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-09 14:23 [d-kernel] [PATCH un-def/sisyphus] config: Enable seeding CRNG from CPU and bootleader Vitaly Chikunov
2022-05-09 16:05 ` Andrey Savchenko
2022-05-10 21:43 ` Vladimir D. Seleznev
2022-05-11 6:01 ` Andrey Savchenko
ALT Linux kernel packages development
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://lore.altlinux.org/devel-kernel/0 devel-kernel/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 devel-kernel devel-kernel/ http://lore.altlinux.org/devel-kernel \
devel-kernel@altlinux.org devel-kernel@altlinux.ru devel-kernel@altlinux.com
public-inbox-index devel-kernel
Example config snippet for mirrors.
Newsgroup available over NNTP:
nntp://lore.altlinux.org/org.altlinux.lists.devel-kernel
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git