* bug#13768: --without-posix code uses scm_getpid() in libguile-2.0.2
@ 2013-02-19 23:38 Jan Schukat
2013-02-24 19:21 ` Andy Wingo
0 siblings, 1 reply; 6+ messages in thread
From: Jan Schukat @ 2013-02-19 23:38 UTC (permalink / raw)
To: 13768
I'm experimenting a little with statically linking a minimal build of
libguile. So while no one really would want to build it it with
--without-posix (except when you want the same functionality on all
platforms including windows in your program), and this is a low priority
bug and I can easily fix it myself for my purposes, it is still a bug.
What happens is, in random.c in random_state_of_last_resort on line 668
scm_getpid is used to seed the random generator. So either a
preprocessor switch or a hand constructed scm like in scm_getpid
(scm_from_ulong(getpid())) should be used there.
Regards
^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#13768: --without-posix code uses scm_getpid() in libguile-2.0.2
2013-02-19 23:38 bug#13768: --without-posix code uses scm_getpid() in libguile-2.0.2 Jan Schukat
@ 2013-02-24 19:21 ` Andy Wingo
2013-02-25 1:17 ` Mark H Weaver
0 siblings, 1 reply; 6+ messages in thread
From: Andy Wingo @ 2013-02-24 19:21 UTC (permalink / raw)
To: Jan Schukat; +Cc: 13768-done
On Wed 20 Feb 2013 00:38, Jan Schukat <shookie@email.de> writes:
> What happens is, in random.c in random_state_of_last_resort on line 668
> scm_getpid is used to seed the random generator. So either a
> preprocessor switch or a hand constructed scm like in scm_getpid
> (scm_from_ulong(getpid())) should be used there.
Fixed, thanks for the report.
Andy
--
http://wingolog.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#13768: --without-posix code uses scm_getpid() in libguile-2.0.2
2013-02-24 19:21 ` Andy Wingo
@ 2013-02-25 1:17 ` Mark H Weaver
2013-02-25 9:06 ` Andy Wingo
0 siblings, 1 reply; 6+ messages in thread
From: Mark H Weaver @ 2013-02-25 1:17 UTC (permalink / raw)
To: 13768; +Cc: shookie
reopen 13768
thanks
Andy Wingo <wingo@pobox.com> writes:
> On Wed 20 Feb 2013 00:38, Jan Schukat <shookie@email.de> writes:
>
>> What happens is, in random.c in random_state_of_last_resort on line 668
>> scm_getpid is used to seed the random generator. So either a
>> preprocessor switch or a hand constructed scm like in scm_getpid
>> (scm_from_ulong(getpid())) should be used there.
>
> Fixed, thanks for the report.
This has potential security implications. If the same program is run
multiple times in the same second, then without something like a PID,
there's a significant danger that two runs of the program will use the
same random seed.
Therefore, I think we ought to try hard to ensure that something like a
PID will always be included in this seed. Perhaps 'scm_getpid' should
be included even when building --without-posix.
At the very least, the documentation (which currently claims that the
PID is included in the random-state-of-last-resort) should be adjusted
to reflect the new reality. I just took care of that.
Thanks,
Mark
^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#13768: --without-posix code uses scm_getpid() in libguile-2.0.2
2013-02-25 1:17 ` Mark H Weaver
@ 2013-02-25 9:06 ` Andy Wingo
2013-02-25 18:58 ` Mark H Weaver
0 siblings, 1 reply; 6+ messages in thread
From: Andy Wingo @ 2013-02-25 9:06 UTC (permalink / raw)
To: Mark H Weaver; +Cc: 13768, shookie
On Mon 25 Feb 2013 02:17, Mark H Weaver <mhw@netris.org> writes:
> Andy Wingo <wingo@pobox.com> writes:
>
>> On Wed 20 Feb 2013 00:38, Jan Schukat <shookie@email.de> writes:
>>
>>> What happens is, in random.c in random_state_of_last_resort on line 668
>>> scm_getpid is used to seed the random generator. So either a
>>> preprocessor switch or a hand constructed scm like in scm_getpid
>>> (scm_from_ulong(getpid())) should be used there.
>>
>> Fixed, thanks for the report.
>
> This has potential security implications. If the same program is run
> multiple times in the same second, then without something like a PID,
> there's a significant danger that two runs of the program will use the
> same random seed.
Our PRNG is not secure. We should not be making arguments from the
perspective of security. (I think including the PID is a good thing,
but not because of security.)
> Therefore, I think we ought to try hard to ensure that something like a
> PID will always be included in this seed. Perhaps 'scm_getpid' should
> be included even when building --without-posix.
Why don't we just add the result of getpid() without relying on the
scm_getpid() binding. All platforms have it.
> At the very least, the documentation (which currently claims that the
> PID is included in the random-state-of-last-resort) should be adjusted
> to reflect the new reality. I just took care of that.
Thanks for following up. TBH though I would prefer that if you already
know the solution, to go ahead and fix it instead of writing a mail and
fixing the docs. Much easier on users (and developers :) if Guile just
does the right thing.
Andy
--
http://wingolog.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#13768: --without-posix code uses scm_getpid() in libguile-2.0.2
2013-02-25 9:06 ` Andy Wingo
@ 2013-02-25 18:58 ` Mark H Weaver
2013-02-25 20:39 ` Andy Wingo
0 siblings, 1 reply; 6+ messages in thread
From: Mark H Weaver @ 2013-02-25 18:58 UTC (permalink / raw)
To: Andy Wingo; +Cc: 13768-done, shookie
Hi Andy,
Andy Wingo <wingo@pobox.com> writes:
> Our PRNG is not secure. We should not be making arguments from the
> perspective of security. (I think including the PID is a good thing,
> but not because of security.)
Indeed, point well taken.
> Why don't we just add the result of getpid() without relying on the
> scm_getpid() binding. All platforms have it.
Ah, good! I didn't know that getpid() was available on MinGW.
> Thanks for following up. TBH though I would prefer that if you already
> know the solution, to go ahead and fix it instead of writing a mail and
> fixing the docs.
Agreed. I didn't know the solution until just now. I have done as you
suggested above, and am now closing this bug.
Thanks,
Mark
^ permalink raw reply [flat|nested] 6+ messages in thread
* bug#13768: --without-posix code uses scm_getpid() in libguile-2.0.2
2013-02-25 18:58 ` Mark H Weaver
@ 2013-02-25 20:39 ` Andy Wingo
0 siblings, 0 replies; 6+ messages in thread
From: Andy Wingo @ 2013-02-25 20:39 UTC (permalink / raw)
To: Mark H Weaver; +Cc: 13768-done, shookie
On Mon 25 Feb 2013 19:58, Mark H Weaver <mhw@netris.org> writes:
>> Why don't we just add the result of getpid() without relying on the
>> scm_getpid() binding. All platforms have it.
>
> Ah, good! I didn't know that getpid() was available on MinGW.
>
>> Thanks for following up. TBH though I would prefer that if you already
>> know the solution, to go ahead and fix it instead of writing a mail and
>> fixing the docs.
>
> Agreed. I didn't know the solution until just now. I have done as you
> suggested above, and am now closing this bug.
Super, thank you!
FWIW, --disable-posix has two uses. One is to work around compilation
failures, and the other is to decrease the "interface size" of Guile.
But sometimes they are a bit entangled, which is the case for scm_getpid
that might get removed when you're just looking to get around some
compilation failure.
Cheers,
Andy
--
http://wingolog.org/
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-02-25 20:39 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-02-19 23:38 bug#13768: --without-posix code uses scm_getpid() in libguile-2.0.2 Jan Schukat
2013-02-24 19:21 ` Andy Wingo
2013-02-25 1:17 ` Mark H Weaver
2013-02-25 9:06 ` Andy Wingo
2013-02-25 18:58 ` Mark H Weaver
2013-02-25 20:39 ` Andy Wingo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).