Open Stack

* Whaley, Graham (graham.whaley at intel.com) wrote:
> > Since you really never want your VMs blocking, I'd suggest just telling
> > qemu to use urandom; you can pass it as a parameter to
> >    -object rng-random
> 
> I think that's probably part of the debate isn't it - if you don't have enough entropy, do you still want to run your VM/container, or do you want to block (or fail after some suitable time) if there is not enough entropy.
> I'm presuming not having enough entropy will result in some potential security implications such as weakening to brute force and side channel attacks etc.

I've not got enough of a crypto-mind to give a good answer to that;
although as far as I can tell people have been arguing about it for
many years.

> For the 'block until there is entropy' option - and I guess this depends what is blocking at current (is it the kernel or the agent) - could we get the agent to bring up the grpc interface and then stall launching the actual container workload until enough entropy is available? (and have that option and the limits set in the kata config file).

Remember that you could also run out of entropy while a VM/container is
running, so it's not that obvious to me that 'before the VM starts'
is any special time to make a decision.

Dave

> > 
> > Dave
> Graham
> 
> ---------------------------------------------------------------------
> Intel Corporation (UK) Limited
> Registered No. 1134945 (England)
> Registered Office: Pipers Way, Swindon SN3 1RJ
> VAT No: 860 2173 47
> 
> This e-mail and any attachments may contain confidential material for
> the sole use of the intended recipient(s). Any review or distribution
> by others is strictly prohibited. If you are not the intended
> recipient, please contact the sender and delete all copies.
--
Dr. David Alan Gilbert / dgilbert at redhat.com / Manchester, UK