From dddf4849ec1750ca02d03b9772eff7141ba626f3 Mon Sep 17 00:00:00 2001 From: Victor Stinner Date: Tue, 7 Jun 2016 11:21:42 +0200 Subject: os.urandom() doesn't block on Linux anymore Issue #26839: On Linux, os.urandom() now calls getrandom() with GRND_NONBLOCK to fall back on reading /dev/urandom if the urandom entropy pool is not initialized yet. Patch written by Colm Buckley. --- Python/random.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) (limited to 'Python/random.c') diff --git a/Python/random.c b/Python/random.c index 79157b8b6f2..ecfd44bbda3 100644 --- a/Python/random.c +++ b/Python/random.c @@ -6,6 +6,9 @@ # ifdef HAVE_SYS_STAT_H # include # endif +# ifdef HAVE_LINUX_RANDOM_H +# include +# endif # ifdef HAVE_GETRANDOM # include # elif defined(HAVE_GETRANDOM_SYSCALL) @@ -122,9 +125,13 @@ py_getrandom(void *buffer, Py_ssize_t size, int raise) /* Is getrandom() supported by the running kernel? * Need Linux kernel 3.17 or newer, or Solaris 11.3 or newer */ static int getrandom_works = 1; - /* Use non-blocking /dev/urandom device. On Linux at boot, the getrandom() - * syscall blocks until /dev/urandom is initialized with enough entropy. */ - const int flags = 0; + + /* getrandom() on Linux will block if called before the kernel has + * initialized the urandom entropy pool. This will cause Python + * to hang on startup if called very early in the boot process - + * see https://bugs.python.org/issue26839. To avoid this, use the + * GRND_NONBLOCK flag. */ + const int flags = GRND_NONBLOCK; int n; if (!getrandom_works) @@ -168,6 +175,17 @@ py_getrandom(void *buffer, Py_ssize_t size, int raise) getrandom_works = 0; return 0; } + if (errno == EAGAIN) { + /* If we failed with EAGAIN, the entropy pool was + * uninitialized. In this case, we return failure to fall + * back to reading from /dev/urandom. + * + * Note: In this case the data read will not be random so + * should not be used for cryptographic purposes. Retaining + * the existing semantics for practical purposes. */ + getrandom_works = 0; + return 0; + } if (errno == EINTR) { if (PyErr_CheckSignals()) { -- cgit v1.2.3