From c7504aeb640a88949dfe3146f7e0f275f517464c Mon Sep 17 00:00:00 2001 From: Pauli Date: Thu, 7 Jun 2018 09:31:44 +1000 Subject: Modify the DEVRANDOM source so that the files are kept open persistently. This allows operation inside a chroot environment without having the random device present. A new call, RAND_keep_random_devices_open(), has been introduced that can be used to control file descriptor use by the random seed sources. Some seed sources maintain open file descriptors by default, which allows such sources to operate in a chroot(2) jail without the associated device nodes being available. Reviewed-by: Matt Caswell Reviewed-by: Matthias St. Pierre (Merged from https://github.com/openssl/openssl/pull/6432) --- doc/man3/RAND_add.pod | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) (limited to 'doc') diff --git a/doc/man3/RAND_add.pod b/doc/man3/RAND_add.pod index 1b06d1be87..b6753fd2ed 100644 --- a/doc/man3/RAND_add.pod +++ b/doc/man3/RAND_add.pod @@ -2,7 +2,8 @@ =head1 NAME -RAND_add, RAND_poll, RAND_seed, RAND_status, RAND_event, RAND_screen +RAND_add, RAND_poll, RAND_seed, RAND_status, RAND_event, RAND_screen, +RAND_keep_random_devices_open - add randomness to the PRNG or get its status =head1 SYNOPSIS @@ -15,6 +16,8 @@ RAND_add, RAND_poll, RAND_seed, RAND_status, RAND_event, RAND_screen void RAND_add(const void *buf, int num, double randomness); void RAND_seed(const void *buf, int num); + void RAND_keep_random_devices_open(int keep); + Deprecated: #if OPENSSL_API_COMPAT < 0x10100000L @@ -54,6 +57,15 @@ should consider using L instead. RAND_seed() is equivalent to RAND_add() with B set to B. +RAND_keep_random_devices_open() is used to control file descriptor +usage by the random seed sources. Some seed sources maintain open file +descriptors by default, which allows such sources to operate in a +chroot(2) jail without the associated device nodes being available. When +the B argument is zero, this call disables the retention of file +descriptors. Conversely, a non-zero argument enables the retention of +file descriptors. This function is usually called during initialization +and it takes effect immediately. + RAND_event() and RAND_screen() are equivalent to RAND_poll() and exist for compatibility reasons only. See HISTORY section below. -- cgit v1.2.3