classification
Title: getrandom() syscall returning EPERM make the system unusable.
Type: behavior Stage:
Components: Versions: Python 3.7, Python 3.6, Python 3.5
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: christian.heimes, iwings, ncoghlan, python-dev, vstinner
Priority: normal Keywords: patch

Created on 2016-09-05 13:25 by iwings, last changed 2017-03-31 16:36 by dstufft. This issue is now closed.

Files
File name Uploaded Description Edit
random.diff iwings, 2016-09-05 13:25 review
Pull Requests
URL Status Linked Edit
PR 552 closed dstufft, 2017-03-31 16:36
Messages (7)
msg274399 - (view) Author: (iwings) Date: 2016-09-05 13:25
On QNAP's Linux Station (lxc based virtual environment), getrandom() syscall returns EPERM not ENOSYS when it's not available.

(HOST) uname -a
Linux ******-NAS 3.12.6 #1 SMP Thu Sep 1 00:57:44 CST 2016 x86_64 unknown

(HOST) /lib64/libc-2.19.so
GNU C Library (Ubuntu EGLIBC 2.19-0ubuntu6.6) stable release version 2.19, by Roland McGrath et al.

(LXC) uname -a
Linux ubuntu_1604 3.12.6 #1 SMP Thu Sep 1 00:57:44 CST 2016 x86_64 x86_64 x86_64 GNU/Linux

(LXC) /lib/x86_64-linux-gnu/libc.so.6
GNU C Library (Ubuntu GLIBC 2.23-0ubuntu3) stable release version 2.23, by Roland McGrath et al.

(LXC)
long n = syscall(SYS_getrandom, buffer, sizeof(buffer), flags);
printf("SYS_getrandom: %ld (%d)\n", n, errno);
=> 
SYS_getrandom: -1 (1)

Proper fall back to /dev/urandom is not happening in this case, so most python app calling getrandom function fails. This includes apt, command-not-found etc.
msg274401 - (view) Author: Christian Heimes (christian.heimes) * (Python committer) Date: 2016-09-05 14:25
Did you open a bug with your vendor, too? QNAP is clearly violating Kernel APIs. getrandom() is not suppose to fail with EPERM. Valid errnos are EINVAL, EFAULT, EAGAIN and EINTR. http://man7.org/linux/man-pages/man2/getrandom.2.html
msg274404 - (view) Author: (iwings) Date: 2016-09-05 15:50
I did not report this to QNAP yet. but there's already a thread on their forum.
https://forum.qnap.com/viewtopic.php?t=124650 (registration required)

- ENOSYS is not listed in that man page, but it occurs.
- EPERM is not listed in that man page, but it can be returned if seccomp filters getrandom() syscall for example.

So preparing for these return values are meaningful not only for QNAP users.
msg274405 - (view) Author: STINNER Victor (vstinner) * (Python committer) Date: 2016-09-05 16:36
I'm ok to fallback on read /dev/urandom device when getrandom() is
blocked by a stupid security policy :-)
msg274744 - (view) Author: Nick Coghlan (ncoghlan) * (Python committer) Date: 2016-09-07 03:55
With #27778 implemented, there's also the question of how os.getrandom() will react to security policies that restrict access to the getrandom syscalls (vs just not having it available in the kernel).
msg277064 - (view) Author: Roundup Robot (python-dev) (Python triager) Date: 2016-09-20 20:52
New changeset 41e9e711b9b5 by Victor Stinner in branch '3.5':
Cleanup random.c
https://hg.python.org/cpython/rev/41e9e711b9b5

New changeset ddc54f08bdfa by Victor Stinner in branch '3.5':
Catch EPERM error in py_getrandom()
https://hg.python.org/cpython/rev/ddc54f08bdfa

New changeset 27d05bb6f832 by Victor Stinner in branch '3.6':
(Merge 3.5) Catch EPERM error in py_getrandom()
https://hg.python.org/cpython/rev/27d05bb6f832
msg277065 - (view) Author: STINNER Victor (vstinner) * (Python committer) Date: 2016-09-20 20:56
I modified Python 3.5, 3.6 and 3.7 to fall back on reading /dev/urandom when getrandom() syscall fails with EPERM.

Thanks for the bug report iwings!

Note: Python 2.7 does not use getrandom() and so is not impacted.


Christian:
> Did you open a bug with your vendor, too? QNAP is clearly violating Kernel APIs. getrandom() is not suppose to fail with EPERM.

I don't know if it can be seen as a violation of the Kernel API, but at least, it doesn't seem to be something smart to block getrandom() syscall. getrandom() was designed to enhance the security of applications ;-)


Nick:
> With #27778 implemented, there's also the question of how os.getrandom() will react to security policies that restrict access to the getrandom syscalls (vs just not having it available in the kernel).

This is no question: os.getrandom() of Python 3.6 is a thin wrapper on the syscall. If the syscall fails, the Python function raises an exception ;-) OSError(EPERM) on this case.
History
Date User Action Args
2017-03-31 16:36:07dstufftsetpull_requests: + pull_request826
2016-09-20 20:56:29vstinnersetstatus: open -> closed
resolution: fixed
messages: + msg277065

versions: + Python 3.7, - Python 2.7
2016-09-20 20:52:43python-devsetnosy: + python-dev
messages: + msg277064
2016-09-07 03:55:41ncoghlansetnosy: + ncoghlan
messages: + msg274744
2016-09-05 16:36:45vstinnersetmessages: + msg274405
2016-09-05 15:50:30iwingssetmessages: + msg274404
2016-09-05 14:25:53christian.heimessetnosy: + vstinner, christian.heimes

messages: + msg274401
versions: + Python 2.7
2016-09-05 13:25:37iwingscreate