Page MenuHomeFreeBSD

include: ssp: fortify <sys/random.h>
ClosedPublic

Authored by kevans on Jun 21 2024, 5:00 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Sep 8, 5:11 PM
Unknown Object (File)
Sat, Sep 7, 9:52 PM
Unknown Object (File)
Sat, Sep 7, 5:52 AM
Unknown Object (File)
Fri, Sep 6, 2:13 PM
Unknown Object (File)
Tue, Sep 3, 8:17 PM
Unknown Object (File)
Aug 11 2024, 10:32 PM
Unknown Object (File)
Aug 11 2024, 10:32 PM
Unknown Object (File)
Aug 11 2024, 10:32 PM
Subscribers

Details

Summary

That is to say, fortify getrandom(2).

Sponsored by: Stormshield
Sponsored by: Klara, Inc.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

Does it make sense in general to fortify non-standard interfaces like arc4random_buf()?

This revision is now accepted and ready to land.Jul 2 2024, 2:25 PM

Does it make sense in general to fortify non-standard interfaces like arc4random_buf()?

I'm curious to hear your thoughts here, because I hadn't considered there may be a reason not to -- their uses are still susceptible to the same kind of easy-to-catch bugs you might make with many of the standardized interfaces, so if they don't add much complexity I assumed it was worth it even if they're not often-used.

Does it make sense in general to fortify non-standard interfaces like arc4random_buf()?

I'm curious to hear your thoughts here, because I hadn't considered there may be a reason not to -- their uses are still susceptible to the same kind of easy-to-catch bugs you might make with many of the standardized interfaces, so if they don't add much complexity I assumed it was worth it even if they're not often-used.

Am I right that this patch series doesn't fortify arc4random_buf(), or did I just miss it? I'd assume it's worth it as well, I don't see a downside.

Does it make sense in general to fortify non-standard interfaces like arc4random_buf()?

I'm curious to hear your thoughts here, because I hadn't considered there may be a reason not to -- their uses are still susceptible to the same kind of easy-to-catch bugs you might make with many of the standardized interfaces, so if they don't add much complexity I assumed it was worth it even if they're not often-used.

Am I right that this patch series doesn't fortify arc4random_buf(), or did I just miss it? I'd assume it's worth it as well, I don't see a downside.

Oh, sorry, it's over in https://reviews.freebsd.org/D45681

Does it make sense in general to fortify non-standard interfaces like arc4random_buf()?

I'm curious to hear your thoughts here, because I hadn't considered there may be a reason not to -- their uses are still susceptible to the same kind of easy-to-catch bugs you might make with many of the standardized interfaces, so if they don't add much complexity I assumed it was worth it even if they're not often-used.

Am I right that this patch series doesn't fortify arc4random_buf(), or did I just miss it? I'd assume it's worth it as well, I don't see a downside.

Oh, sorry, it's over in https://reviews.freebsd.org/D45681

I did miss it, my bad. I had just forgotten about that patch.

This revision was automatically updated to reflect the committed changes.