From 83cf49aa369bc35b2938a21376f75fa5acb61248 Mon Sep 17 00:00:00 2001 From: Filip Schauer Date: Tue, 18 Feb 2025 12:10:54 +0100 Subject: [PATCH] remove outdated /dev/random entropy-starvation warnings Remove mentions about entropy-starvation, when using /dev/random as the entropy source, from the descriptions of the rng parameters. This concern no longer applies since the removal of the blocking entropy pool in kernel version 5.6. [1] [2] [1] https://git.kernel.org/torvalds/c/acd77500aa8a337baa6d853568c4b55aca48e20f [2] https://lwn.net/Articles/808575/ Signed-off-by: Filip Schauer --- PVE/QemuServer.pm | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/PVE/QemuServer.pm b/PVE/QemuServer.pm index 96786a96..244430c4 100644 --- a/PVE/QemuServer.pm +++ b/PVE/QemuServer.pm @@ -261,18 +261,15 @@ my $rng_fmt = { type => 'string', enum => ['/dev/urandom', '/dev/random', '/dev/hwrng'], default_key => 1, - description => "The file on the host to gather entropy from. In most cases '/dev/urandom'" - ." should be preferred over '/dev/random' to avoid entropy-starvation issues on the" - ." host. Using urandom does *not* decrease security in any meaningful way, as it's" - ." still seeded from real entropy, and the bytes provided will most likely be mixed" - ." with real entropy on the guest as well. '/dev/hwrng' can be used to pass through" - ." a hardware RNG from the host.", + description => "The file on the host to gather entropy from. Using urandom does *not*" + ." decrease security in any meaningful way, as it's still seeded from real entropy, and" + ." the bytes provided will most likely be mixed with real entropy on the guest as well." + ."'/dev/hwrng' can be used to pass through a hardware RNG from the host.", }, max_bytes => { type => 'integer', description => "Maximum bytes of entropy allowed to get injected into the guest every" - ." 'period' milliseconds. Prefer a lower value when using '/dev/random' as source. Use" - ." `0` to disable limiting (potentially dangerous!).", + ." 'period' milliseconds. Use `0` to disable limiting (potentially dangerous!).", optional => 1, # default is 1 KiB/s, provides enough entropy to the guest to avoid boot-starvation issues