From e39d13656889639655ceec15ab3a1aa5a4e50652 Mon Sep 17 00:00:00 2001 From: Adam Langley Date: Wed, 21 Aug 2019 15:44:15 -0700 Subject: [PATCH] Require getrandom in Android FIPS builds. In order to make the entropy story a little simplier, drop support for using /dev/urandom from Android FIPS builds. Change-Id: I4c35618dcae1550142e60a886a8b51ba0df765a3 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/37205 Commit-Queue: David Benjamin Reviewed-by: David Benjamin --- crypto/fipsmodule/rand/urandom.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/crypto/fipsmodule/rand/urandom.c b/crypto/fipsmodule/rand/urandom.c index 56e4fbd25..f63857f82 100644 --- a/crypto/fipsmodule/rand/urandom.c +++ b/crypto/fipsmodule/rand/urandom.c @@ -183,6 +183,12 @@ static void init_once(void) { } #endif // USE_NR_getrandom + // Android FIPS builds must support getrandom. +#if defined(BORINGSSL_FIPS) && defined(OPENSSL_ANDROID) + perror("getrandom not found"); + abort(); +#endif + if (fd == kUnset) { do { fd = open("/dev/urandom", O_RDONLY);