SCS Entropy: Implementation and Testing Notes
Implementation
We presume that almost nothing has to be done (or indeed can be done), as long as the CPUs and VM images are reasonably recent; only the flavor and image attributes have to be set:
- flavor:
hw_rng:allowed=True
, - image:
hw_rng_model: virtio
.
Automated Tests
Images Sample
Some checks need to be performed on a live instance. For these checks, it is necessary to choose a sample of VM images to test on.
For the time being, the sample MUST contain at least one public image reported by OpenStack. This may be extended in the future.
Errors
For every image in the chosen sample, the following items MUST be detected and reported as an error:
- the service
rngd
is not running, - the special file
/proc/sys/kernel/random/entropy_avail
does not contain the value 256 (pinned since kernel 5.18), - the number of FIPS 140-2 failures exceeds 3 out of 1000 blocks
tested, as determined by
cat /dev/random | rngtest -c 1000
.
Note: The latter two items act as surrogates for the following item, which cannot be detected directly:
- CPU instructions for accessing entropy are not available to the VMs.
Warnings
The following items MUST be detected and reported as a warning:
- any flavor missing the attribute
hw_rng:allowed=True
, - any image missing the attribute
hw_rng_model: virtio
,
Note that the requirement regarding the kernel patch level will not be
checked, because of two reasons: (a) we already check the file entropy_avail
(see subsection on Errors), and (b) users can always choose a recent image,
as ensured by the image metadata standard.
Implementation
The script entropy-check.py
connects to OpenStack and performs the checks described in this section.
Manual Tests
None.