Skip to content

random: Override random with FIPS RNG in FIPS mode

Upstream: RHEL only Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1984784

The RHEL FIPS certification effort ran into an show-stopper with /dev/urandom and getrandom(2) not being FIPS-compliant. At this point there is no realistic chance of making them FIPS-compliant upstream. It has also been deemed unrealistic to change user-space to use the FIPS-compliant RNG through the Crypto API.

Therefore this patch series overrides /dev/*random as well as getrandom(2) with the Crypto API RNG so that FIPS certification can proceed.

Signed-off-by: Herbert Xu herbert.xu@redhat.com

Merge request reports

Loading