Red Hat Bugzilla – Bug 1347642
Enable /dev/urandom as source of entropy for virtio-rng
Last modified: 2016-11-03 14:47:20 EDT
Description of problem: see bug 1074464 for details. The bug is already fixed upstream and in current build of libvirt in RHEL 7.3. This BZ is filed for proper release/dependency tracking. Version-Release number of selected component (if applicable): 7.2 version of libvirt: libvirt-daemon-1.2.17-13.el7_2.4.x86_64 How reproducible: always Steps to Reproduce: 1. add this to <devices> in domain XML: <rng model='virtio'> <backend model='random'>/dev/urandom</backend> </rng> 2. virsh start $domain 3. Actual results: libvirt refuses to start the domain Expected results: libvirt starts the domain Additional info:
Fixed upstream by: commit 67f2b72723c242969c5282fcb9acf00cc01f2a54 Author: Cole Robinson <crobinso@redhat.com> CommitDate: 2016-04-26 11:43:33 -0400 conf: Drop restrictions on rng backend path Currently we only allow /dev/random and /dev/hwrng as host input for <rng><backend model='random'/> device. This was added after various upstream discussions in commit 4932ef45 However this restriction has generated quite a few complaints over the years, so a new discussion was initiated: http://www.redhat.com/archives/libvir-list/2016-April/msg00987.html Several people suggested removing the restriction, and nobody really spoke up to defend it. So this patch drops the path restriction entirely https://bugzilla.redhat.com/show_bug.cgi?id=1074464 git describe: v1.3.4-rc1 contains: v1.3.4-rc1^0
Reproduce this bug with libvirt-1.2.17-13.el7_2.5.x86_64 Steps to reproduce: 1.Add this to <devices> in domain XML: <rng model='virtio'> <backend model='random'>/dev/urandom</backend> </rng> 2. # virsh start $domain error: XML document failed to validate against schema: Unable to validate doc against /usr/share/libvirt/schemas/domain.rng Extra element devices in interleave Element domain failed to validate content Failed. Try again? [y,n,i,f,?]: 3. Define domain from an XML file with the rng device above: # virsh define testvm_bak.xml error: Failed to define domain from testvm_bak.xml error: XML error: file '/dev/urandom' is not a supported random source Verify this bug with libvirt-2.0.0-4.el7.x86_64 Steps to verify: 1. Add this to <devices> in domain XML: <rng model='virtio'> <backend model='random'>/dev/urandom</backend> </rng> 2. # virsh start $domain Domain started successfully. 3.Check the domain xml file # virsh dumpxml testvm|grep -A3 rng <rng model='virtio'> <backend model='random'>/dev/urandom</backend> <alias name='rng0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/> </rng> </devices> 4.login guest to check virtio-rng working status # lsmod |grep rng virtio_rng 13019 0 virtio_ring 21524 6 virtio_blk,virtio_net,virtio_pci,virtio_rng,virtio_balloon,virtio_console virtio 15008 6 virtio_blk,virtio_net,virtio_pci,virtio_rng,virtio_balloon,virtio_console # dd if=/dev/hwrng of=/tmp/random ^C4699+1 records in 4699+0 records out 2405888 bytes (2.4 MB) copied, 3.88595 s, 619 kB/s Since the result is as expected, mark this bug as verified.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHSA-2016-2577.html