Fatal glibc error: cannot get entropy for arc4random

[Elan Ruusamäe]

On 23.07.2024 10:57, Arkadiusz Miśkiewicz via pld-devel-en wrote:
> On 22/07/2024 17:16, Elan Ruusamäe wrote:
>> cannot get entropy for arc4random
>
> Try maybe this code to see if it works (+ strace for it).
>
> It blocks getrandom syscall (ENOSYS) on x86_64 with seccomp. 


strace of that program


# strace ./seccomp-test
execve("./seccomp-test", ["./seccomp-test"], 0x7fff233e1f50 /* 39 vars 
*/) = 0
brk(NULL)                               = 0x15a6000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or 
directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=32151, ...}) = 0
mmap(NULL, 32151, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f7873452000
close(3)                                = 0
openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, 
"\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20b\2\0\0\0\0\0"..., 
832) = 832
pread64(3, 
"\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 
64) = 784
fstat(3, {st_mode=S_IFREG|0755, st_size=1966536, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) 
= 0x7f7873450000
pread64(3, 
"\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 
64) = 784
mmap(NULL, 2018704, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 
0x7f7873263000
mmap(0x7f7873287000, 1441792, PROT_READ|PROT_EXEC, 
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x24000) = 0x7f7873287000
mmap(0x7f78733e7000, 352256, PROT_READ, 
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x184000) = 0x7f78733e7000
mmap(0x7f787343d000, 24576, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1d9000) = 0x7f787343d000
mmap(0x7f7873443000, 52624, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f7873443000
close(3)                                = 0
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 
0) = 0x7f7873260000
arch_prctl(ARCH_SET_FS, 0x7f7873260740) = 0
set_tid_address(0x7f7873260a10)         = 22077
set_robust_list(0x7f7873260a20, 24)     = 0
rseq(0x7f7873261060, 0x20, 0, 0x53053053) = -1 ENOSYS (Function not 
implemented)
mprotect(0x7f787343d000, 16384, PROT_READ) = 0
mprotect(0x403000, 4096, PROT_READ)     = 0
mprotect(0x7f787348d000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, 
rlim_max=RLIM64_INFINITY}) = 0
munmap(0x7f7873452000, 32151)           = 0
prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)  = 0
prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, {len=7, 
filter=0x7fffb093fd90}) = 0
fstat(1, {st_mode=S_IFCHR|0622, st_rdev=makedev(0x88, 0x5), ...}) = 0
getrandom(0x7f7873448178, 8, GRND_NONBLOCK) = -1 ENOSYS (Function not 
implemented)
brk(NULL)                               = -1 ENOSYS (Function not 
implemented)
brk(0x15c7000)                          = -1 ENOSYS (Function not 
implemented)
Testing arc4random() after blocking getrandom syscall:
write(1, "Testing arc4random() after block"..., 55) = -1 ENOSYS 
(Function not implemented)
writev(2, [{iov_base="Fatal glibc error: cannot get en"..., 
iov_len=53}], 1Fatal glibc error: cannot get entropy for arc4random
) = 53
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) 
= 0x7f7873459000
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
gettid()                                = 22077
getpid()                                = 22077
tgkill(22077, 22077, SIGABRT)           = 0
--- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=22077, si_uid=0} ---
+++ killed by SIGABRT +++
Aborted



i also updated libseccomp. it didn't change a thing


U libseccomp-(2.5.1 => 2.5.5)-1.x86_64