cpython: ddc54f08bdfa (original) (raw)

Mercurial > cpython

changeset 103972:ddc54f08bdfa 3.5

Catch EPERM error in py_getrandom() Issue #27955: Fallback on reading /dev/urandom device when the getrandom() syscall fails with EPERM, for example when blocked by SECCOMP. [#27955]

Victor Stinner victor.stinner@gmail.com
date	Tue, 20 Sep 2016 22:46:02 +0200
parents	41e9e711b9b5
children	27d05bb6f832 06efc625578a
files	Misc/NEWS Python/random.c
diffstat	2 files changed, 11 insertions(+), 7 deletions(-)[+] [-] Misc/NEWS 3 Python/random.c 15

line wrap: on

line diff

--- a/Misc/NEWS +++ b/Misc/NEWS @@ -10,6 +10,9 @@ Release date: TBA Core and Builtins ----------------- +- Issue #27955: Fallback on reading /dev/urandom device when the getrandom()

syscall fails with EPERM, for example when blocked by SECCOMP. +

Issue #28131: Fix a regression in zipimport's compile_source(). zipimport should use the same optimization level as the interpreter.

--- a/Python/random.c +++ b/Python/random.c @@ -121,8 +121,8 @@ py_getentropy(unsigned char buffer, Py_ / Call getrandom() - Return 1 on success

- Return 0 if getrandom() syscall is not available (failed with ENOSYS)

or if getrandom(GRND_NONBLOCK) failed with EAGAIN (system urandom[](#l2.8)

- Return 0 if getrandom() syscall is not available (failed with ENOSYS or
```
EPERM) or if getrandom(GRND_NONBLOCK) failed with EAGAIN (system urandom[](#l2.10)
not initialized yet) and raise=0.[](#l2.11)
```
- Raise an exception (if raise is non-zero) and return -1 on error: getrandom() failed with EINTR and the Python signal handler raised an

@@ -131,7 +131,7 @@ static int py_getrandom(void buffer, Py_ssize_t size, int raise) { / Is getrandom() supported by the running kernel? Set to 0 if getrandom()

  failed with ENOSYS. Need Linux kernel 3.17 or newer, or Solaris[](#l2.18)

```
  failed with ENOSYS or EPERM. Need Linux kernel 3.17 or newer, or Solaris[](#l2.19)
  11.3 or newer */[](#l2.20)
```
static int getrandom_works = 1; @@ -182,8 +182,9 @@ py_getrandom(void buffer, Py_ssize_t si if (n < 0) { / ENOSYS: getrandom() syscall not supported by the kernel (but

        * maybe supported by the host which built Python). */[](#l2.27)

```
       if (errno == ENOSYS) {[](#l2.28)
```

        * maybe supported by the host which built Python). EPERM:[](#l2.29)

        * getrandom() syscall blocked by SECCOMP or something else. */[](#l2.30)

       if (errno == ENOSYS || errno == EPERM) {[](#l2.31)
           getrandom_works = 0;[](#l2.32)
           return 0;[](#l2.33)
       }[](#l2.34)

@@ -250,7 +251,7 @@ dev_urandom_noraise(unsigned char *buffe if (py_getrandom(buffer, size, 0) == 1) { return; }

/* getrandom() failed with ENOSYS,

/* getrandom() failed with ENOSYS or EPERM, fall back on reading /dev/urandom */

#endif @@ -301,7 +302,7 @@ dev_urandom_python(char *buffer, Py_ssiz if (res == 1) { return 0; }

/* getrandom() failed with ENOSYS,

/* getrandom() failed with ENOSYS or EPERM, fall back on reading /dev/urandom */

#endif