Messages in this thread | | | Date | Tue, 24 Aug 2004 16:26:37 -0500 | From | Matt Mackall <> | Subject | Re: [PATCH] [4/4] /dev/random: Remove RNDGETPOOL ioctl |
| |
On Fri, Aug 20, 2004 at 12:57:23AM -0400, Theodore Ts'o wrote: > > Recently, someone has kvetched that RNDGETPOOL is a "security > vulnerability". Never mind that it is superuser only, and with > superuser privs you could load a nasty kernel module, or read the > entropy pool out of /dev/mem directly, but they are nevertheless still > spreading FUD.
While such concerns are a bit exaggerated, the ioctl isn't in fact very useful: it only gets one of the pools. In other words, it's been obsolete even for debugging purposes since we went to two pools.
The pool resize ioctl is still racy in a painful way and ought to be axed as well.
-- Mathematics is the supreme nostalgia of our time. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |