Bug 1347642

Summary: Enable /dev/urandom as source of entropy for virtio-rng
Product: Red Hat Enterprise Linux 7 Reporter: David Jaša <djasa>
Component: libvirtAssignee: Libvirt Maintainers <libvirt-maint>
Status: CLOSED ERRATA QA Contact: Virtualization Bugs <virt-bugs>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 7.2CC: dyuan, jtomko, rbalakri, yafu, yanqzhan, zpeng
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: libvirt-1.3.4-1.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-11-03 18:47:20 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1074464    
Bug Blocks: 1347669, 1374227    

Description David Jaša 2016-06-17 10:09:51 UTC
Description of problem:
see bug 1074464 for details. The bug is already fixed upstream and in current build of libvirt in RHEL 7.3. This BZ is filed for proper release/dependency tracking.

Version-Release number of selected component (if applicable):
7.2 version of libvirt: libvirt-daemon-1.2.17-13.el7_2.4.x86_64

How reproducible:

Steps to Reproduce:
1. add this to <devices> in domain XML:
    <rng model='virtio'>
      <backend model='random'>/dev/urandom</backend>
2. virsh start $domain

Actual results:
libvirt refuses to start the domain

Expected results:
libvirt starts the domain

Additional info:

Comment 1 Ján Tomko 2016-06-17 10:36:16 UTC
Fixed upstream by:
commit 67f2b72723c242969c5282fcb9acf00cc01f2a54
Author:     Cole Robinson <crobinso@redhat.com>
CommitDate: 2016-04-26 11:43:33 -0400

    conf: Drop restrictions on rng backend path
    Currently we only allow /dev/random and /dev/hwrng as host input
    for <rng><backend model='random'/> device. This was added after
    various upstream discussions in commit 4932ef45
    However this restriction has generated quite a few complaints over
    the years, so a new discussion was initiated:
    Several people suggested removing the restriction, and nobody really
    spoke up to defend it. So this patch drops the path restriction

git describe: v1.3.4-rc1 contains: v1.3.4-rc1^0

Comment 3 yanqzhan@redhat.com 2016-08-09 04:38:46 UTC
Reproduce this bug with libvirt-1.2.17-13.el7_2.5.x86_64
Steps to reproduce:

1.Add this to <devices> in domain XML:
    <rng model='virtio'>
    <backend model='random'>/dev/urandom</backend>

2. # virsh start $domain
error: XML document failed to validate against schema: Unable to validate doc against /usr/share/libvirt/schemas/domain.rng
Extra element devices in interleave
Element domain failed to validate content

Failed. Try again? [y,n,i,f,?]: 

3. Define domain from an XML file with the rng device above:
   # virsh define testvm_bak.xml
    error: Failed to define domain from testvm_bak.xml
    error: XML error: file '/dev/urandom' is not a supported random source

Verify this bug with libvirt-2.0.0-4.el7.x86_64
Steps to verify:

1. Add this to <devices> in domain XML:
<rng model='virtio'>
<backend model='random'>/dev/urandom</backend>

2. # virsh start $domain
Domain started successfully.

3.Check the domain xml file

   # virsh dumpxml testvm|grep -A3 rng
    <rng model='virtio'>
    <backend model='random'>/dev/urandom</backend>
    <alias name='rng0'/>
    <address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/>

4.login guest to check virtio-rng working status

   # lsmod |grep rng
    virtio_rng 13019 0
    virtio_ring 21524 6 virtio_blk,virtio_net,virtio_pci,virtio_rng,virtio_balloon,virtio_console
    virtio 15008 6 virtio_blk,virtio_net,virtio_pci,virtio_rng,virtio_balloon,virtio_console

   # dd if=/dev/hwrng of=/tmp/random
^C4699+1 records in
4699+0 records out
2405888 bytes (2.4 MB) copied, 3.88595 s, 619 kB/s

Since the result is as expected, mark this bug as verified.

Comment 5 errata-xmlrpc 2016-11-03 18:47:20 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.