Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I use Knoppix (or other Live CDs/DVDs) as a secure environment for creating valuable crypto keys. Unfortunately entropy is a limited resource in such environments. I just noticed that each program start consumes quite some entropy. This seems to be due to some stack protection feature that needs address randomization.

Nice feature but completely useless and - worse - destructive in my scenario. Is there any possibility to disable this feature? I would prefer one that allows me to continue using the original Knoppix (or whatever) image and just need some configuration at runtime.

I read that this was caused by glibc. I am surprised that an strace -p $PID -f -e trace=open against bash does not show any accesses to /dev/random when I start programs. But I am not familiar with the interaction of execve() and the linker.

share|improve this question
    
You could always invest in a hardware encryption card. –  jordanm Apr 10 '13 at 4:30
2  
"completely useless" = actually a security feature universal to modern operating systems... Ps. the kernel does this, so there is no userspace -> system call to trace. –  goldilocks Apr 10 '13 at 7:56
    
ASLR calls get_random_int. get_random_int has changed several times but I don't see it depleting the entropy. What kernel version did you notice this on? What architecture? Is the kernel compiled with CONFIG_ARCH_RANDOM? –  Gilles Apr 11 '13 at 0:02
    
By the way, Linux's /dev/random's entropy fetishism is misplaced. If there's enough entropy in the system, /dev/urandom is fine for key generation, and does not consume entropy. –  Gilles Apr 11 '13 at 0:07
4  
@goldilocks Be honest when you quote: "[...] completely useless [...] in my scenario" –  Hauke Laging Apr 11 '13 at 0:34

1 Answer 1

up vote 17 down vote accepted
+50

If this is indeed due to address randomization (ASLR has to do with where the program is loaded, see here: http://en.wikipedia.org/wiki/Address_space_layout_randomization) then you can disable it by passing norandmaps to the kernel in the boot options (see here: http://www.linuxtopia.org/online_books/linux_kernel/kernel_configuration/re30.html).

share|improve this answer
    
This kernel parameter indeed solves the problem. –  Hauke Laging Apr 11 '13 at 0:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.