Hello. I'm attaching patches for adding the arc4random(3) library function. The patch includes a manual page. This function uses the free Arcfour (another-rc4) stream cipher, seeded with entropy. This function is intended for non-cryptographic uses, such as for mktemp. As-is this patch takes 128 bits from /dev/urandom, or gettimeofday/getpid if /dev/urandom is not available. This can be more flexable, to use hp-timing. I would suggest arc4random() is used in place of hp-timing throughout the Glibc package, with the exception of the stack protector (for performance reasons), and use hp-timing in arc4random.c.
Created attachment 1734 [details] --with-prng-device patch This patch adds --with-prng-device= to allow users to specify their /dev/urandom or /dev/arandom or /dev/erandom, to use with ssp and arc4random, and future.
Created attachment 1735 [details] arc4random() patch This patch adds the arc4random() code. It depends on the prng patch to build it as-is.
Created attachment 1736 [details] arc4random mktemp/tempname patch This patch is for tempname.c to make mktemp, and friends, use arc4random().
In resolv/res_init.c, res_randomid() could use arc4random() instead of getpid().
glibc is no dumping ground for arbitrary code. The existing code is just find. Put your code in separate libraries.
Florian Weimer posted another implementation of arc4random() in https://sourceware.org/ml/libc-alpha/2018-05/msg00891.html
I'm working on this.
I am working on a new version for arc4random.
Added on 2.36.