From e6785ee16dce675aa770616bcdbd128d5dfb1132 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Wed, 16 Apr 2014 14:54:39 -0400 Subject: Get Libevent's PRNG functioning under the linux sandbox Libevent uses an arc4random implementation (I know, I know) to generate DNS transaction IDs and capitalization. But it liked to initialize it either with opening /dev/urandom (which won't work under the sandbox if it doesn't use the right pointer), or with sysctl({CTL_KERN,KERN_RANDOM,RANDOM_UUIC}). To make _that_ work, we were permitting sysctl unconditionally. That's not such a great idea. Instead, we try to initialize the libevent PRNG _before_ installing the sandbox, and make sysctl always fail with EPERM under the sandbox. --- configure.ac | 1 + 1 file changed, 1 insertion(+) (limited to 'configure.ac') diff --git a/configure.ac b/configure.ac index 6e4104196..6e5331b4c 100644 --- a/configure.ac +++ b/configure.ac @@ -435,6 +435,7 @@ AC_CHECK_FUNCS([event_get_version \ event_set_log_callback \ evdns_set_outgoing_bind_address \ evutil_secure_rng_set_urandom_device_file \ + evutil_secure_rng_init \ event_base_loopexit]) AC_CHECK_MEMBERS([struct event.min_heap_idx], , , [#include -- cgit v1.2.3