getrandom(2): Add Linux GRND_INSECURE API flag

Treat it as a synonym for GRND_NONBLOCK.  The reasoning is this:

We have two choices for handling Linux's GRND_INSECURE API flag.

1. We could ignore it completely (like GRND_RANDOM).  However, this might
produce the surprising result of GRND_INSECURE requests blocking, when the
Linux API does not block.

2. Alternatively, we could treat GRND_INSECURE requests as requests for
GRND_NONBLOCk.  Here, the surprising result for Linux programs is that
invocations with unseeded random(4) will produce EAGAIN, rather than
garbage.

Honoring the flag in the way Linux does seems fraught.  If we actually use
the output of a random(4) implementation prior to seeding, we leak some
entropy (in an information theory and also practical sense) from what will
be the initial seed to attackers (or allow attackers to arbitrary DoS
initial seeding, if we don't leak).  This seems unacceptable -- it defeats
the purpose of blocking on initial seeding.

Secondary to that concern, before seeding we may have arbitrarily little
entropy collected; producing output from zero or a handful of entropy bits
does not seem particularly useful to userspace.

If userspace can accept garbage, insecure, non-random bytes, they can create
their own insecure garbage with srandom(time(NULL)) or similar.  Any program
which would be satisfied with a 3-bit key CTR stream has no need for CSPRNG
bytes.  So asking the kernel to produce such an output from the secure
getrandom(2) API seems inane.

For now, we've elected to emulate GRND_INSECURE as an alternative spelling
of GRND_NONBLOCK (2).  Consider this API not-quite stable for now.  We
guarantee it will never block.  But we will attempt to monitor actual port
uptake of this bizarre API and may revise our plans for the unseeded
behavior (prior stable/13 branching).

Approved by:	csprng(markm), manpages(bcr)
See also:	https://lwn.net/ml/linux-kernel/cover.1577088521.git.luto@kernel.org/
See also:	https://lwn.net/ml/linux-kernel/20200107204400.GH3619@mit.edu/
Differential Revision:	https://reviews.freebsd.org/D23130

1 files changed, 35 insertions, 1 deletions

diff --git a/sys/kern/sys_getrandom.c b/sys/kern/sys_getrandom.c
index 67881a342a7b..612820cdbcc3 100644
--- a/sys/kern/sys_getrandom.c
+++ b/sys/kern/sys_getrandom.c
@@ -38,7 +38,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/uio.h>
 
-#define GRND_VALIDFLAGS	(GRND_NONBLOCK | GRND_RANDOM)
+#define GRND_VALIDFLAGS	(GRND_NONBLOCK | GRND_RANDOM | GRND_INSECURE)
 
 /*
  * random_read_uio(9) returns EWOULDBLOCK if a nonblocking request would block,
@@ -60,6 +60,40 @@ kern_getrandom(struct thread *td, void *user_buf, size_t buflen,
 	if (buflen > IOSIZE_MAX)
 		return (EINVAL);
 
+	/*
+	 * Linux compatibility: We have two choices for handling Linux's
+	 * GRND_INSECURE.
+	 *
+	 * 1. We could ignore it completely (like GRND_RANDOM).  However, this
+	 * might produce the surprising result of GRND_INSECURE requests
+	 * blocking, when the Linux API does not block.
+	 *
+	 * 2. Alternatively, we could treat GRND_INSECURE requests as requests
+	 * for GRND_NONBLOCk.  Here, the surprising result for Linux programs
+	 * is that invocations with unseeded random(4) will produce EAGAIN,
+	 * rather than garbage.
+	 *
+	 * Honoring the flag in the way Linux does seems fraught.  If we
+	 * actually use the output of a random(4) implementation prior to
+	 * seeding, we leak some entropy about the initial seed to attackers.
+	 * This seems unacceptable -- it defeats the purpose of blocking on
+	 * initial seeding.
+	 *
+	 * Secondary to that concern, before seeding we may have arbitrarily
+	 * little entropy collected; producing output from zero or a handful of
+	 * entropy bits does not seem particularly useful to userspace.
+	 *
+	 * If userspace can accept garbage, insecure non-random bytes, they can
+	 * create their own insecure garbage with srandom(time(NULL)) or
+	 * similar.  Asking the kernel to produce it from the secure
+	 * getrandom(2) API seems inane.
+	 *
+	 * We elect to emulate GRND_INSECURE as an alternative spelling of
+	 * GRND_NONBLOCK (2).
+	 */
+	if ((flags & GRND_INSECURE) != 0)
+		flags |= GRND_NONBLOCK;
+
 	if (buflen == 0) {
 		td->td_retval[0] = 0;
 		return (0);