* Mark Wielaard: > Hi Florian, > > On Sat, Jun 13, 2026 at 12:04:08PM +0200, Florian Weimer wrote: >> > On Wed, 2026-06-03 at 17:12 -0400, Aaron Merey wrote: >> >> On Tue, Jun 2, 2026 at 6:47 AM Mark Wielaard <[email protected]> wrote: >> >> > + do >> >> > + { >> >> > + uint64_t r; /* We need at least 64^6 == 2^36 */ >> >> > + if (TEMP_FAILURE_RETRY (getrandom (&r, sizeof (r), 0)) != sizeof >> >> > (r)) >> >> >> >> getrandom was introduced in glibc 2.25 (Feb 2017) so it's probably safer >> >> if >> >> we add a configure check for getrandom or <sys/random.h>. There's one >> >> already >> >> for reallocarray (glibc 2.26) plus fallbacks if it's missing. >> > >> > I would hope 9 years is old enough. But yeah. I'll add a "fallback >> > getrandom" for systems that don't have it. Meh. >> >> It can also be blocked by a seccomp filter in a container. > > Groan, do people really do that?
I'm not sure. There is probably some desire to minimize the system calls exposed to containers, especially since the recent kernel vulnerabilities. Most container runtimes still in use should have picked up the system call by now (and run on kernels with support), so you wouldn't see the ENOSYS as the default anymore. Thanks, Florian
