wp_seed_src: read /dev/urandom via raw fd to avoid seccomp SIGSYS#440
Open
ColtonWilley wants to merge 2 commits into
Open
wp_seed_src: read /dev/urandom via raw fd to avoid seccomp SIGSYS#440ColtonWilley wants to merge 2 commits into
ColtonWilley wants to merge 2 commits into
Conversation
SEED-SRC opened /dev/urandom with XFOPEN (buffered fopen). The first fread pulls read-ahead into the stdio buffer. sshd primes its RNG before the privsep fork, so the preauth child inherits that buffered FILE*; at child exit glibc stdio cleanup calls lseek() to drop the unread read-ahead. lseek() isn't in OpenSSH's preauth seccomp filter, so the child is killed with SIGSYS. Use a raw fd (open/read/close, O_CLOEXEC) instead: no buffer, no read-ahead, no exit-time lseek, matching OpenSSL's own device seeding. The fd and wolfSSL seed callback are shared and reference counted across provider contexts; the last unload closes the fd and restores the seed callback to wc_GenerateSeed (not NULL, which fails wc_InitRng with DRBG_NO_SEED_CB under FIPS). Also fixes a re-init leak that orphaned the prior buffered handle.
padelsbach
reviewed
Jul 10, 2026
padelsbach
left a comment
padelsbach
left a comment
Contributor
There was a problem hiding this comment.
Good improvement. Couple nits
|
|
||
| (void)os; | ||
|
|
||
| if (WP_URANDOM_LOCK() != 0) { |
Contributor
There was a problem hiding this comment.
In addition to the lock, should probably check that the refcount >= 1 just to make sure the file is still open
| { | ||
| if (g_urandom_fd == XBADFD) { | ||
| do { | ||
| g_urandom_fd = open(URANDOM_PATH, O_RDONLY | O_CLOEXEC); |
Contributor
There was a problem hiding this comment.
Can we use XOPEN here for consistency?
SEED-SRC caches the /dev/urandom descriptor by number. Under OpenSSH's inetd-mode (sshd -i) privsep setup the parent dup2's its own descriptors over low fd numbers, reusing the number SEED-SRC cached. The forked, seccomp-sandboxed preauth child then inherits g_urandom_fd pointing at the wrong (non-blocking) descriptor; its reseed read returns EAGAIN, reseed_prngs fails, and the connection is dropped - the agent-pkcs11 regress failure. Record the device identity (dev/ino/mode/rdev) via fstat at open time and, like OpenSSL's check_random_device(), revalidate the cached fd before each read. If the number was reused, abandon it without closing (it belongs to the host now) and reopen. An fstat EACCES (a sandbox that denies fstat) is inconclusive, so the inherited fd is kept; EBADF means the fd was closed, so reopen. The cleanup close is likewise guarded so a reused descriptor is never closed. Add regression test T4 (fd-reuse) to test_seccomp_sandbox.c: it dup2's a non-blocking pipe over the cached fd, forces a parent reseed, and verifies a sandboxed child still reseeds from a valid fd.
ColtonWilley
added
ci:all
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
SEED-SRC read
/dev/urandomthrough a buffered stdioFILE*(XFOPEN). That breaks OpenSSH's privsep preauth child:sshdprimes its RNG (seed_rng->RAND_status) before the privsep fork, so the firstfreadpulls a block of read-ahead into the stdio buffer.FILE*and its fd.lseek()to discard the unread read-ahead.lseek()is not in OpenSSH's preauth seccomp allow-list, so the child is killed withSIGSYS(audit showssig=31 syscall=8).Stock OpenSSL reads the device with a raw fd and never hits this; the buffered
FILE*was the defect. Separately, re-initializing SEED-SRC (a second provider load) orphaned the previous buffered handle.Fix
/dev/urandomwith a raw fd (open/read/close,O_CLOEXEC). No stdio buffer, so no read-ahead and no exit-timelseek.wc_GenerateSeed— notNULL, which would make a laterwc_InitRngfailDRBG_NO_SEED_CBunder FIPS.NO_WOLFSSL_DIRbuilds#errorrather than silently falling back.Tests
test_seccomp_sandbox— runs under the verbatim OpenSSH 9.9p1 preauth filter: single-context (the original crash), re-init, and multi-context survivor. Compiled in with-DWP_TEST_SECCOMP_SANDBOX(enabled by theseed-srcCI job; a skip stub otherwise, since it needsPR_SET_SECCOMP).test_seed_src_refcount— multi-context refcount; the first unload must not close the shared fd.test_seed_src_reload— drives the refcount to zero (fd close + seed-callback restore) and reloads; re-exec'd so the count actually reaches zero, which the main suite's own reference otherwise prevents.