[PATCH v2] stdlib: Consolidate getentropy and adapt to POSIX 2024 semantics

[Mark Harris]

On Thu, Mar 27, 2025, Adhemerval Zanella Netto wrote:
> On 27/03/25 11:29, Andreas Schwab wrote:
> > On Mär 27 2025, Adhemerval Zanella wrote:
> >
> >>   2. There is no defined error if no entropy could be obtained.
> >>      It means that the function should not fail.
> >
> > The standard says:
> >
> >         The getentropy() function may fail if:
> >
> >         [ENOSYS]
> >                 The system does not provide the necessary source of entropy.
> >
>
> The code still returns ENOSYS if getrandom() is not supported.  The question
> is how to handle unexpected getrandom() issues (which should be possible
> in theory).  Should I change to just return ENOSYS in this case?

POSIX does not restrict errors to those specifically listed.
Specifically, section 2.3 Error Numbers states:

Implementations shall not generate a different error number from one
required by this volume of POSIX.1-2024 for an error condition
described in this volume of POSIX.1-2024, but may generate additional
errors unless explicitly disallowed for a particular function.
<https://pubs.opengroup.org/onlinepubs/9799919799/functions/V2_chap02.html#tag_16_03>

It appears from the current and historical kernel code that the only
errors that could be produced by the mainline Linux kernel for the
getrandom() system call or vDSO with flags = 0 are ENOSYS, EINTR, and
EFAULT.  (If the vDSO is used then it may produce a segmentation fault
rather than EFAULT.)  In the proposed patch, ENOSYS and EINTR are
handled explicitly, and EFAULT and any other error results in
__libc_fatal ("Fatal glibc error: cannot get entropy for
getentropy\n").  The message seems misleading, because it suggests an
issue with the entropy gathering code, whereas EFAULT is much more
likely to be caused by a bug in the user code.

Is there a reason to not just return the kernel-provided errno when it
is not EINTR (whether it is ENOSYS or EFAULT, or something
unexpected), as the current implementation does?  Glibc propagates
EFAULT and Linux-specific errors from other POSIX-defined functions
even though POSIX does not specifically list them.


 - Mark