Public bug reported:
SRU Justification
Impact: Turning this option on will make our kernels by default trust
the CPU's random number generator for the purpose of initializing the
kernel's CRNG on Intel, AMD, and IBM CPUs. Users can disable this at
boot time by passing random.trust_cpu=off. Turning this on has the
potential to prevent getrandom(2) from blocking during early boot. This
option was turned on in the master kernel shortly before disco kernel
freeze; this bug is about propagating the option to derivative kernels.
Regression Potential: No user-visible regressions are expected. Some
security-conscious users may prefer to not trust the CPU maker's RNG,
but in that case the boot options is available.
Test Case: The benefit is difficult to verify empirically in Ubuntu
kernels since we carry a patch to avoid problems with getrandom(2)
blocking immediately following boot. However, it is possible to see
whether or not the kernel used the CPU RNG for initializing the CRNG by
searching for the string "random: crng done (trusting CPU's
manufacturer)" in dmesg.
** Affects: linux-aws (Ubuntu)
Importance: Undecided
Status: New
** Affects: linux-azure (Ubuntu)
Importance: High
Assignee: Seth Forshee (sforshee)
Status: In Progress
** Affects: linux-gcp (Ubuntu)
Importance: Undecided
Status: New
** Affects: linux-kvm (Ubuntu)
Importance: Undecided
Status: New
** Also affects: linux-aws (Ubuntu)
Importance: Undecided
Status: New
** Also affects: linux-gcp (Ubuntu)
Importance: Undecided
Status: New
** Also affects: linux-kvm (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1823754
Title:
Set CONFIG_RANDOM_TRUST_CPU=y
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-aws/+bug/1823754/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
