Fatal glibc error: cannot get entropy for arc4random

[Arkadiusz Miśkiewicz]

On 22/07/2024 17:16, Elan Ruusamäe wrote:
> cannot get entropy for arc4random

Try maybe this code to see if it works (+ strace for it).

It blocks getrandom syscall (ENOSYS) on x86_64 with seccomp.

-- 
Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )
-------------- next part --------------
#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <errno.h>
#include <sys/prctl.h>
#include <linux/seccomp.h>
#include <linux/filter.h>
#include <linux/audit.h>
#include <stdlib.h>
#include <stddef.h>

#ifndef __NR_getrandom
#define __NR_getrandom 318
#endif

int main() {
    struct sock_filter filter[] = {
        BPF_STMT(BPF_LD + BPF_W + BPF_ABS, offsetof(struct seccomp_data, arch)),
        BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, AUDIT_ARCH_X86_64, 1, 0),
        BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_KILL),

        BPF_STMT(BPF_LD + BPF_W + BPF_ABS, offsetof(struct seccomp_data, nr)),

        BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, __NR_getrandom, 1, 0),

        BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ALLOW),

        BPF_STMT(BPF_RET + BPF_K, SECCOMP_RET_ERRNO | ENOSYS),
    };

    struct sock_fprog prog = {
        .len = (unsigned short)(sizeof(filter) / sizeof(filter[0])),
        .filter = filter,
    };

    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
        perror("prctl(PR_SET_NO_NEW_PRIVS)");
        return 1;
    }

    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) {
        perror("prctl(PR_SET_SECCOMP)");
        return 1;
    }

    printf("Testing arc4random() after blocking getrandom syscall:\n");
    unsigned int random_value = arc4random();
    printf("arc4random() returned: %u\n", random_value);

    return 0;
}