• Jason A. Donenfeld's avatar
    random: remove ratelimiting for in-kernel unseeded randomness · cc1e127b
    Jason A. Donenfeld authored
    The CONFIG_WARN_ALL_UNSEEDED_RANDOM debug option controls whether the
    kernel warns about all unseeded randomness or just the first instance.
    There's some complicated rate limiting and comparison to the previous
    caller, such that even with CONFIG_WARN_ALL_UNSEEDED_RANDOM enabled,
    developers still don't see all the messages or even an accurate count of
    how many were missed. This is the result of basically parallel
    mechanisms aimed at accomplishing more or less the same thing, added at
    different points in random.c history, which sort of compete with the
    first-instance-only limiting we have now.
    
    It turns out, however, that nobody cares about the first unseeded
    randomness instance of in-kernel users. The same first user has been
    there for ages now, and nobody is doing anything about it. It isn't even
    clear that anybody _can_ do anything about it. Most places that can do
    something about it have switched over to using get_random_bytes_wait()
    or wait_for_random_bytes(), which is the right thing to do, but there is
    still much code that needs randomness sometimes during init, and as a
    geeneral rule, if you're not using one of the _wait functions or the
    readiness notifier callback, you're bound to be doing it wrong just
    based on that fact alone.
    
    So warning about this same first user that can't easily change is simply
    not an effective mechanism for anything at all. Users can't do anything
    about it, as the Kconfig text points out -- the problem isn't in
    userspace code -- and kernel developers don't or more often can't react
    to it.
    
    Instead, show the warning for all instances when CONFIG_WARN_ALL_UNSEEDED_RANDOM
    is set, so that developers can debug things need be, or if it isn't set,
    don't show a warning at all.
    
    At the same time, CONFIG_WARN_ALL_UNSEEDED_RANDOM now implies setting
    random.ratelimit_disable=1 on by default, since if you care about one
    you probably care about the other too. And we can clean up usage around
    the related urandom_warning ratelimiter as well (whose behavior isn't
    changing), so that it properly counts missed messages after the 10
    message threshold is reached.
    
    Cc: Theodore Ts'o <tytso@mit.edu>
    Cc: Dominik Brodowski <linux@dominikbrodowski.net>
    Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
    cc1e127b
random.c 49.4 KB