Re: [bitfolk] Dear Entropy service users, what software uses /dev/random?

Hi, I listened to some of the ubuntu podcast on the way in to work this morning and they mentioned the util "fatrace". Turns out you can't use the fanotify functions with /dev, but I've managed to figure out a good way of doing this. Assuming you've got SystemTap (kernel probing functionality, see at the end of the email) installed, then try: sudo stap random_read.stp where random_read.stp looks like: probe kernel.function("random_read").call { printf("%s[%d] len:%d\n", execname(), tid(), $nbytes) } This will print out the executable name, process id and number of bytes requested each time a process reads from /dev/random. You can verify it with e.g. dd if=/dev/random of=/dev/null count=1 FWIW, whilst I was testing I was using urandom_read instead and exim was reading from there, not from random_read. ymmv. The only thing I've seen so far is "dd" :) I'll leave it running and report back if I spot anything. This is the first time I've played with systemtap and I may have missed something. I'm not sure that the ".call" should be there for example. Cheers, Roger Installation notes for ubuntu: apt-get install systemtap # Install kernel debug symbols, this is less optimal than it could be. See

codename=$(lsb_release -c | awk '{print $2}') sudo tee /etc/apt/sources.list.d/ddebs.list << EOF deb http://ddebs.ubuntu.com/ ${codename} main restricted universe multiverse deb http://ddebs.ubuntu.com/ ${codename}-security main restricted universe multiverse deb http://ddebs.ubuntu.com/ ${codename}-updates main restricted universe multiverse deb http://ddebs.ubuntu.com/ ${codename}-proposed main restricted universe multiverse EOF sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys

sudo apt-get update sudo apt-get install linux-image-$(uname -r)-dbgsym On Mon, Mar 14, 2016 at 10:24 AM, Andy Smith &lt;andy(a)bitfolk.com&gt; wrote: > On Mon, Mar 14, 2016 at 10:22:28AM +0000, Andy Smith wrote: >> $ sudo strace -o open -p $(pgrep exim4) 2>&1 | grep random > > Hmm, maybe need a -ff on that to follow forks… > > > _______________________________________________ > users mailing list > users(a)lists.bitfolk.com > https://lists.bitfolk.com/mailman/listinfo/users >