Fedora Account System
Red Hat Associate
Red Hat Customer
/usr/libexec/ipsec/rsasigkey contains an overriding, incompatible definition of the getrandom function. This will cause problems if NSS ever switches to getrandom for seeding its own PRNG because it will then use the function in the rsasigkey program, not the one from the GNU C Library, due to the way ELF symbol interposition works. It is probably best to remove the seedbits handling altogether and keep the -s option for backwards compatibility, but otherwise ignore it. I assume that NSS seeds its PRNG properly on its own.
The seedbits are a BSI requirements and cannot be removed. These are meant to be on top of the NSS seeding done on initialization. I've renamed it to lsw_getrandom() upstream, will be in 3.20
(In reply to Paul Wouters from comment #1) > The seedbits are a BSI requirements and cannot be removed. These are meant > to be on top of the NSS seeding done on initialization. Which BSI would that be? Why is this code only in libreswan and not every single user of NSS (or at least those users performing key generation)?
https://www.bsi.bund.de/EN/Home/home_node.html
note the function was renamed to lsw_getrandom() in version 3.20 which is in fedora, so I think this bug can be closed?
Yes, libreswan no longer appears in my interposition reports.