wrong/missing permissions for device file /dev/prandom (prng.ko)

Default Comment by Bridge

Thank you for taking the time to report this bug and helping to make Ubuntu better. It seems that your bug report is not filed about a specific source package though, rather it is just filed against Ubuntu in general. It is important that bug reports be filed about source packages so that people interested in the package can find the bugs about it. You can find some hints about determining what package your bug might be about at https://wiki.ubuntu.com/Bugs/FindRightPackage. You might also ask for help in the #ubuntu-bugs irc channel on Freenode.

To change the source package that this bug is filed about visit https://bugs.launchpad.net/ubuntu/+bug/1558275/+editstatus and add the package name in the text box next to the word Package.

[This is an automated message. I apologize if it reached you inappropriately; please just reply to this message indicating so.]

------- Comment From <email address hidden> 2016-03-17 08:22 EDT-------
(In reply to comment #7)
> Thank you for taking the time to report this bug and helping to make Ubuntu
> better. It seems that your bug report is not filed about a specific source
> package though, rather it is just filed against Ubuntu in general. It is
> important that bug reports be filed about source packages so that people
> interested in the package can find the bugs about it. You can find some
> hints about determining what package your bug might be about at
> https://wiki.ubuntu.com/Bugs/FindRightPackage. You might also ask for help
> in the #ubuntu-bugs irc channel on Freenode.
>
> To change the source package that this bug is filed about visit
> https://bugs.launchpad.net/ubuntu/+bug/1558275/+editstatus and add the
> package name in the text box next to the word Package.
>
> [This is an automated message. I apologize if it reached you
> inappropriately; please just reply to this message indicating so.]

Done - the package in question is: linux-image-4.4.0-13-generic

@christian rund

no =) linux-lts-xenial is not the right package. that is a backport kernel to trusty.... and there is no s390x support in trusty.

The permissions on the device are correct, as far as kernel is concerned. s390-tools documentation suggests that in practice it should be 0444. Thus s390-tools should ship such a udev rule, or such udev rule should be contributed upstream to systemd udev component.

This is not a bug in Ubuntu, this is an upstream issue that affects all Linux on Z. Please escalate this bug to s390-tools upstream and/or systemd upstream.

For example, KVM for IBM z Systems 1.1.0 (Z) is also affected, and the device has following permissions:

# ls -latr /dev/prandom
crw------- 1 root root 10, 57 Mar 17 13:41 /dev/prandom

------- Comment From <email address hidden> 2016-03-17 10:35 EDT-------
Hi Dimitri,

(In reply to comment #12)
> This is not a bug in Ubuntu, this is an upstream issue that affects all
> Linux on Z. Please escalate this bug to s390-tools upstream and/or systemd
> upstream.

I already started this discussion and probably correct the file mode directly in the prandom device driver. I will let you know when I have news on this issue.

Cool, reopening the bug task for linux package then, and setting it to incomplete.

Once there is an accepted patch for this, do drop a line here to ping the kernel team to get this included.

Regards,

Dimitri.

------- Comment From <email address hidden> 2016-04-05 06:56 EDT-------
Please backport upstream commit:

commit 74b2375e6767935e6d9220bdbc6ed0db57f71a59
Author: Harald Freudenberger <email address hidden>
Date: Thu Mar 17 14:52:17 2016 +0100

s390/crypto: provide correct file mode at device register.
When the prng device driver calls misc_register() there is the possibility
to also provide the recommented file permissions. This fix now gives
useful values (0644) where previously just the default was used (resulting
in 0600 for the device file).
Signed-off-by: Harald Freudenberger <email address hidden>
Signed-off-by: Martin Schwidefsky <email address hidden>

arch/s390/crypto/prng.c | 2 ++
1 file changed, 2 insertions(+)

This bug was fixed in the package linux - 4.4.0-18.34

---------------
linux (4.4.0-18.34) xenial; urgency=low

  [ Tim Gardner ]

  * Release Tracking Bug
    - LP: #1566868

  * [i915_bpo] Fix RC6 on SKL GT3 & GT4 (LP: #1564759)
    - SAUCE: i915_bpo: drm/i915/skl: Fix rc6 based gpu/system hang
    - SAUCE: i915_bpo: drm/i915/skl: Fix spurious gpu hang with gt3/gt4 revs

  * CONFIG_ARCH_ROCKCHIP not enabled in armhf generic kernel (LP: #1566283)
    - [Config] CONFIG_ARCH_ROCKCHIP=y

  * [Feature] Memory Bandwidth Monitoring (LP: #1397880)
    - perf/x86/cqm: Fix CQM handling of grouping events into a cache_group
    - perf/x86/cqm: Fix CQM memory leak and notifier leak
    - x86/cpufeature: Carve out X86_FEATURE_*
    - Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
    - x86/topology: Create logical package id
    - perf/x86/mbm: Add Intel Memory B/W Monitoring enumeration and init
    - perf/x86/mbm: Add memory bandwidth monitoring event management
    - perf/x86/mbm: Implement RMID recycling
    - perf/x86/mbm: Add support for MBM counter overflow handling

  * User namespace mount updates (LP: #1566505)
    - SAUCE: quota: Require that qids passed to dqget() be valid and map into s_user_ns
    - SAUCE: fs: Allow superblock owner to change ownership of inodes with unmappable ids
    - SAUCE: fuse: Don't initialize user_id or group_id in mount options
    - SAUCE: cgroup: Use a new super block when mounting in a cgroup namespace
    - SAUCE: fs: fix a posible leak of allocated superblock

  * [arm64] kernel BUG at /build/linux-StrpB2/linux-4.4.0/fs/ext4/inode.c:2394!
    (LP: #1566518)
    - arm64: Honour !PTE_WRITE in set_pte_at() for kernel mappings
    - arm64: Update PTE_RDONLY in set_pte_at() for PROT_NONE permission

  * [Feature]USB core and xHCI tasks for USB 3.1 SuperSpeedPlus (SSP) support
    for Alpine Ridge on SKL (LP: #1519623)
    - usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices
    - usb: set USB 3.1 roothub device speed to USB_SPEED_SUPER_PLUS
    - usb: show speed "10000" in sysfs for USB 3.1 SuperSpeedPlus devices
    - usb: add device descriptor for usb 3.1 root hub
    - usb: Support USB 3.1 extended port status request
    - xhci: Make sure xhci handles USB_SPEED_SUPER_PLUS devices.
    - xhci: set roothub speed to USB_SPEED_SUPER_PLUS for USB3.1 capable controllers
    - xhci: USB 3.1 add default Speed Attributes to SuperSpeedPlus device capability
    - xhci: set slot context speed field to SuperSpeedPlus for USB 3.1 SSP devices
    - usb: Add USB3.1 SuperSpeedPlus Isoc Endpoint Companion descriptor
    - usb: Parse the new USB 3.1 SuperSpeedPlus Isoc endpoint companion descriptor
    - usb: Add USB 3.1 Precision time measurement capability descriptor support
    - xhci: refactor and cleanup endpoint initialization.
    - xhci: Add SuperSpeedPlus high bandwidth isoc support to xhci endpoints
    - xhci: cleanup isoc tranfers queuing code
    - xhci: Support extended burst isoc TRB structure used by xhci 1.1 for USB 3.1
    - SAUCE: (noup) usb: fix regression in SuperSpeed endpoint descriptor parsing

  * wrong/missing permissions for device f...

------- Comment From <email address hidden> 2016-04-12 11:18 EDT-------
Permissions for /dev/prandom device file are as expected now with kernel 4.4.0-18-generic. 'tester' user was able to read random data from the device.

Details
=====
Created a test user and loaded the prng module.
uid=1000(tester) gid=1000(tester) groups=1000(tester)
tester@s35lp35:~$ ll /dev/prandom
crw-r--r-- 1 root root 10, 54 Apr 12 17:08 /dev/prandom

tester@s35lp35:~$ modinfo prng
filename: /lib/modules/4.4.0-18-generic/kernel/arch/s390/crypto/prng.ko
description: s390 PRNG interface
author: IBM Corporation
license: GPL
srcversion: 60384609D5BAFDCBFD35A32
alias: cpu:type:*:feature:*0003*
depends:
intree: Y
vermagic: 4.4.0-18-generic SMP mod_unload modversions
parm: mode:int
parm: prng_mode:PRNG mode: 0 - auto, 1 - TDES, 2 - SHA512
parm: chunksize:int
parm: prng_chunk_size:PRNG read chunk size in bytes
parm: reseed_limit:int
parm: prng_reseed_limit:PRNG reseed limit