Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that the RNG is ready before using

From	Daniel Micay <danielmicay@gmail.com>
Newsgroups	linux.kernel
Subject	Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that the RNG is ready before using
Date	2017-06-07 19:10 +0200
Message-ID	<tPMD0-11z-15@gated-at.bofh.it> (permalink)
References	(3 earlier) <tPdOV-3t1-1@gated-at.bofh.it> <tPeBj-42I-5@gated-at.bofh.it> <tPlWb-lw-57@gated-at.bofh.it> <tPq9t-3eA-29@gated-at.bofh.it> <tPuZr-6kh-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

> On the better bootloaders, an initramfs segment can be loaded
> independently (and you can have as many as required), which makes an
> early_initramfs a more palatable vector to inject large amounts of
> entropy into the next boot than, say, modifying the kernel image
> directly at every boot/shutdown to stash entropy in there somewhere.

Modifying the kernel image on storage isn't compatible with verified
boot so it's not really a solution. The kernel, initrd and rest of the
OS are signed and verified on operating systems like Android, Android
Things, ChromeOS and many embedded devices, etc. putting some basic
effort into security. I didn't really understand the device tree
approach and mentioned a few times before. Passing via the kernel
cmdline is a lot simpler than modifying the device tree in-memory and
persistent modification isn't an option unless verified boot is missing
anyway.

Thread

[PATCH v3 04/13] crypto/rng: ensure that the RNG is ready before using "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-06 03:00 +0200
  Re: [PATCH v3 04/13] crypto/rng: ensure that the RNG is ready before  using Theodore Ts'o <tytso@mit.edu> - 2017-06-06 05:10 +0200
    Re: [PATCH v3 04/13] crypto/rng: ensure that the RNG is ready before using "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-06 06:00 +0200
      Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using Eric Biggers <ebiggers3@gmail.com> - 2017-06-06 06:50 +0200
        Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-06 14:40 +0200
          Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-06 17:30 +0200
            Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using Eric Biggers <ebiggers3@gmail.com> - 2017-06-06 19:30 +0200
              Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-06 19:40 +0200
          Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using Theodore Ts'o <tytso@mit.edu> - 2017-06-06 19:10 +0200
            Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-06 19:30 +0200
            Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that the RNG is ready before using Stephan Müller <smueller@chronox.de> - 2017-06-06 20:00 +0200
              Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using "Jason A. Donenfeld" <Jason@zx2c4.com> - 2017-06-06 20:10 +0200
            Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using Henrique de Moraes Holschuh <hmh@hmh.eng.br> - 2017-06-07 00:20 +0200
              Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using Theodore Ts'o <tytso@mit.edu> - 2017-06-07 01:20 +0200
              Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that the RNG is ready before using Stephan Müller <smueller@chronox.de> - 2017-06-07 07:10 +0200
                Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using Henrique de Moraes Holschuh <hmh@hmh.eng.br> - 2017-06-07 16:50 +0200
                Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using Theodore Ts'o <tytso@mit.edu> - 2017-06-07 23:30 +0200
              Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using Daniel Micay <danielmicay@gmail.com> - 2017-06-07 19:10 +0200
                Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using Mark Rutland <mark.rutland@arm.com> - 2017-06-07 19:30 +0200
                Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using Daniel Micay <danielmicay@gmail.com> - 2017-06-08 06:00 +0200
            Re: [kernel-hardening] Re: [PATCH v3 04/13] crypto/rng: ensure that  the RNG is ready before using Mark Rutland <mark.rutland@arm.com> - 2017-06-07 19:40 +0200
      Re: [PATCH v3 04/13] crypto/rng: ensure that the RNG is ready before  using Kevin Easton <kevin@guarana.org> - 2017-06-08 14:10 +0200

csiph-web