This can be disabled at boot time with: random.trust_cpu=off random.trust_bootloader=off Signed-off-by: Vitaly Chikunov <vt@altlinux.org> --- config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config b/config index e529911fd5dc..5b817e945274 100644 --- a/config +++ b/config @@ -4479,8 +4479,8 @@ CONFIG_XILLYBUS_CLASS=m CONFIG_XILLYBUS=m CONFIG_XILLYBUS_PCIE=m # CONFIG_XILLYUSB is not set -# CONFIG_RANDOM_TRUST_CPU is not set -# CONFIG_RANDOM_TRUST_BOOTLOADER is not set +CONFIG_RANDOM_TRUST_CPU=y +CONFIG_RANDOM_TRUST_BOOTLOADER=y # end of Character devices # -- 2.33.2
[-- Attachment #1: Type: text/plain, Size: 833 bytes --] On Mon, 9 May 2022 17:23:00 +0300 Vitaly Chikunov wrote: > This can be disabled at boot time with: > random.trust_cpu=off > random.trust_bootloader=off > > Signed-off-by: Vitaly Chikunov <vt@altlinux.org> > --- > config | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/config b/config > index e529911fd5dc..5b817e945274 100644 > --- a/config > +++ b/config > @@ -4479,8 +4479,8 @@ CONFIG_XILLYBUS_CLASS=m > CONFIG_XILLYBUS=m > CONFIG_XILLYBUS_PCIE=m > # CONFIG_XILLYUSB is not set > -# CONFIG_RANDOM_TRUST_CPU is not set > -# CONFIG_RANDOM_TRUST_BOOTLOADER is not set > +CONFIG_RANDOM_TRUST_CPU=y > +CONFIG_RANDOM_TRUST_BOOTLOADER=y These sources are not trusted in most cases, so please avoid enabling them by default for everyone. Best regards, Andrew Savchenko [-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]
On Mon, May 09, 2022 at 07:05:01PM +0300, Andrey Savchenko wrote:
> On Mon, 9 May 2022 17:23:00 +0300 Vitaly Chikunov wrote:
> > This can be disabled at boot time with:
> > random.trust_cpu=off
> > random.trust_bootloader=off
> >
> > Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
> > ---
> > config | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/config b/config
> > index e529911fd5dc..5b817e945274 100644
> > --- a/config
> > +++ b/config
> > @@ -4479,8 +4479,8 @@ CONFIG_XILLYBUS_CLASS=m
> > CONFIG_XILLYBUS=m
> > CONFIG_XILLYBUS_PCIE=m
> > # CONFIG_XILLYUSB is not set
> > -# CONFIG_RANDOM_TRUST_CPU is not set
> > -# CONFIG_RANDOM_TRUST_BOOTLOADER is not set
> > +CONFIG_RANDOM_TRUST_CPU=y
> > +CONFIG_RANDOM_TRUST_BOOTLOADER=y
>
> These sources are not trusted in most cases, so please avoid
> enabling them by default for everyone.
It's a very horrible world where you cannot trust to your CPU.
--
WBR,
Vladimir D. Seleznev
[-- Attachment #1: Type: text/plain, Size: 1478 bytes --] On Wed, 11 May 2022 00:43:37 +0300 Vladimir D. Seleznev wrote: > On Mon, May 09, 2022 at 07:05:01PM +0300, Andrey Savchenko wrote: > > On Mon, 9 May 2022 17:23:00 +0300 Vitaly Chikunov wrote: > > > This can be disabled at boot time with: > > > random.trust_cpu=off > > > random.trust_bootloader=off > > > > > > Signed-off-by: Vitaly Chikunov <vt@altlinux.org> > > > --- > > > config | 4 ++-- > > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > > > diff --git a/config b/config > > > index e529911fd5dc..5b817e945274 100644 > > > --- a/config > > > +++ b/config > > > @@ -4479,8 +4479,8 @@ CONFIG_XILLYBUS_CLASS=m > > > CONFIG_XILLYBUS=m > > > CONFIG_XILLYBUS_PCIE=m > > > # CONFIG_XILLYUSB is not set > > > -# CONFIG_RANDOM_TRUST_CPU is not set > > > -# CONFIG_RANDOM_TRUST_BOOTLOADER is not set > > > +CONFIG_RANDOM_TRUST_CPU=y > > > +CONFIG_RANDOM_TRUST_BOOTLOADER=y > > > > These sources are not trusted in most cases, so please avoid > > enabling them by default for everyone. > > It's a very horrible world where you cannot trust to your CPU. The concept of trust is not binary. I do not trust RDRAND for sensitive materials. Even more so I do not trust UEFI platform generators. E.g. see: https://arstechnica.com/gadgets/2019/10/how-a-months-old-amd-microcode-bug-destroyed-my-weekend/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0543 Welcome to the real world. Best regards, Andrew Savchenko [-- Attachment #2: Type: application/pgp-signature, Size: 833 bytes --]