Bug 1347642 - Enable /dev/urandom as source of entropy for virtio-rng
Summary: Enable /dev/urandom as source of entropy for virtio-rng
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: libvirt
Version: 7.2
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Libvirt Maintainers
QA Contact: Virtualization Bugs
Depends On: 1074464
Blocks: 1347669 1374227
TreeView+ depends on / blocked
Reported: 2016-06-17 10:09 UTC by David Jaša
Modified: 2016-11-03 18:47 UTC (History)
6 users (show)

Fixed In Version: libvirt-1.3.4-1.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2016-11-03 18:47:20 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2577 0 normal SHIPPED_LIVE Moderate: libvirt security, bug fix, and enhancement update 2016-11-03 12:07:06 UTC

Description David Jaša 2016-06-17 10:09:51 UTC
Description of problem:
see bug 1074464 for details. The bug is already fixed upstream and in current build of libvirt in RHEL 7.3. This BZ is filed for proper release/dependency tracking.

Version-Release number of selected component (if applicable):
7.2 version of libvirt: libvirt-daemon-1.2.17-13.el7_2.4.x86_64

How reproducible:

Steps to Reproduce:
1. add this to <devices> in domain XML:
    <rng model='virtio'>
      <backend model='random'>/dev/urandom</backend>
2. virsh start $domain

Actual results:
libvirt refuses to start the domain

Expected results:
libvirt starts the domain

Additional info:

Comment 1 Ján Tomko 2016-06-17 10:36:16 UTC
Fixed upstream by:
commit 67f2b72723c242969c5282fcb9acf00cc01f2a54
Author:     Cole Robinson <crobinso@redhat.com>
CommitDate: 2016-04-26 11:43:33 -0400

    conf: Drop restrictions on rng backend path
    Currently we only allow /dev/random and /dev/hwrng as host input
    for <rng><backend model='random'/> device. This was added after
    various upstream discussions in commit 4932ef45
    However this restriction has generated quite a few complaints over
    the years, so a new discussion was initiated:
    Several people suggested removing the restriction, and nobody really
    spoke up to defend it. So this patch drops the path restriction

git describe: v1.3.4-rc1 contains: v1.3.4-rc1^0

Comment 3 yanqzhan@redhat.com 2016-08-09 04:38:46 UTC
Reproduce this bug with libvirt-1.2.17-13.el7_2.5.x86_64
Steps to reproduce:

1.Add this to <devices> in domain XML:
    <rng model='virtio'>
    <backend model='random'>/dev/urandom</backend>

2. # virsh start $domain
error: XML document failed to validate against schema: Unable to validate doc against /usr/share/libvirt/schemas/domain.rng
Extra element devices in interleave
Element domain failed to validate content

Failed. Try again? [y,n,i,f,?]: 

3. Define domain from an XML file with the rng device above:
   # virsh define testvm_bak.xml
    error: Failed to define domain from testvm_bak.xml
    error: XML error: file '/dev/urandom' is not a supported random source

Verify this bug with libvirt-2.0.0-4.el7.x86_64
Steps to verify:

1. Add this to <devices> in domain XML:
<rng model='virtio'>
<backend model='random'>/dev/urandom</backend>

2. # virsh start $domain
Domain started successfully.

3.Check the domain xml file

   # virsh dumpxml testvm|grep -A3 rng
    <rng model='virtio'>
    <backend model='random'>/dev/urandom</backend>
    <alias name='rng0'/>
    <address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/>

4.login guest to check virtio-rng working status

   # lsmod |grep rng
    virtio_rng 13019 0
    virtio_ring 21524 6 virtio_blk,virtio_net,virtio_pci,virtio_rng,virtio_balloon,virtio_console
    virtio 15008 6 virtio_blk,virtio_net,virtio_pci,virtio_rng,virtio_balloon,virtio_console

   # dd if=/dev/hwrng of=/tmp/random
^C4699+1 records in
4699+0 records out
2405888 bytes (2.4 MB) copied, 3.88595 s, 619 kB/s

Since the result is as expected, mark this bug as verified.

Comment 5 errata-xmlrpc 2016-11-03 18:47:20 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.