Merge pull request #3345 from kmjohansen/topics/kj/rngd-eintr

rngd exits after being stopped and resumed

examples/aws.yml

@@ -16,7 +16,7 @@ onboot:
     image: linuxkit/metadata:v0.7
 services:
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: sshd
     image: linuxkit/sshd:v0.7
     binds:

examples/azure.yml

@@ -11,7 +11,7 @@ onboot:
     image: linuxkit/sysctl:v0.7
 services:
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: dhcpcd
     image: linuxkit/dhcpcd:v0.7
   - name: sshd

examples/cadvisor.yml

@@ -26,7 +26,7 @@ services:
     env:
       - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: ntpd
     image: linuxkit/openntpd:v0.7
 

examples/dm-crypt-loop.yml

@@ -38,7 +38,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
 files:
   - path: etc/dm-crypt/key
     # the below key is just to keep the example self-contained

examples/dm-crypt.yml

@@ -32,7 +32,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
 files:
   - path: etc/dm-crypt/key
     # the below key is just to keep the example self-contained

examples/docker.yml

@@ -22,7 +22,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: dhcpcd
     image: linuxkit/dhcpcd:v0.7
   - name: ntpd

examples/gcp.yml

@@ -20,7 +20,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: sshd
     image: linuxkit/sshd:v0.7
     binds:

examples/getty.yml

@@ -19,7 +19,7 @@ services:
     #env:
     # - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
 files:
   - path: etc/getty.shadow
     # sample sets password for root to "abcdefgh" (without quotes)

examples/hostmount-writeable-overlay.yml

@@ -30,7 +30,7 @@ services:
           destination: writeable-host-etc
           options: ["rw", "lowerdir=/etc", "upperdir=/run/hostetc/upper", "workdir=/run/hostetc/work"]
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: nginx
     image: nginx:1.13.8-alpine
     capabilities:

examples/node_exporter.yml

@@ -11,7 +11,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: dhcpcd
     image: linuxkit/dhcpcd:v0.7
   - name: node_exporter

examples/openstack.yml

@@ -17,7 +17,7 @@ onboot:
     command: ["/usr/bin/metadata", "openstack"]
 services:
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: sshd
     image: linuxkit/sshd:v0.7
     binds:

examples/packet.yml

@@ -10,7 +10,7 @@ init:
   - linuxkit/firmware:v0.7
 onboot:
   - name: rngd1
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
     command: ["/sbin/rngd", "-1"]
   - name: sysctl
     image: linuxkit/sysctl:v0.7
@@ -22,7 +22,7 @@ onboot:
     command: ["/usr/bin/metadata", "packet"]
 services:
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: getty
     image: linuxkit/getty:v0.7
     env:

examples/rt-for-vmware.yml

@@ -15,7 +15,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: dhcpcd
     image: linuxkit/dhcpcd:v0.7
   - name: open-vm-tools

examples/scaleway.yml

@@ -10,7 +10,7 @@ onboot:
   - name: sysctl
     image: linuxkit/sysctl:v0.7
   - name: rngd1
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
     command: ["/sbin/rngd", "-1"]
   - name: dhcpcd
     image: linuxkit/dhcpcd:v0.7
@@ -23,7 +23,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
 trust:
   org:
     - linuxkit

examples/sshd.yml

@@ -10,7 +10,7 @@ onboot:
   - name: sysctl
     image: linuxkit/sysctl:v0.7
   - name: rngd1
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
     command: ["/sbin/rngd", "-1"]
 services:
   - name: getty
@@ -18,7 +18,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: dhcpcd
     image: linuxkit/dhcpcd:v0.7
   - name: sshd

examples/swap.yml

@@ -28,7 +28,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
 trust:
   org:
     - linuxkit

examples/tpm.yml

@@ -20,7 +20,7 @@ services:
   - name: tss
     image: linuxkit/tss:v0.7
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
 files:
   - path: etc/getty.shadow
     # sample sets password for root to "abcdefgh" (without quotes)

examples/vmware.yml

@@ -15,7 +15,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: dhcpcd
     image: linuxkit/dhcpcd:v0.7
   - name: nginx

examples/vultr.yml

@@ -20,7 +20,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: sshd
     image: linuxkit/sshd:v0.7
     binds:

examples/wireguard.yml

@@ -45,7 +45,7 @@ services:
      - INSECURE=true
     net: /run/netns/wg1
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: nginx
     image: nginx:1.13.8-alpine
     net: /run/netns/wg0

linuxkit.yml

@@ -22,7 +22,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: nginx
     image: nginx:1.13.8-alpine
     capabilities:

pkg/rngd/cmd/rngd/main.go

@@ -9,6 +9,7 @@ import (
 	"flag"
 	"log"
 	"os"
+	"syscall"
 	"unsafe"
 
 	"golang.org/x/sys/unix"
@@ -62,6 +63,17 @@ func main() {
 		// sleep until we can write more
 		nevents, err := unix.EpollWait(epfd, events[:], timeout)
 		if err != nil {
+			// According to signal(7) on Linux, epoll_wait(2) returns EINTR if
+			// the system call is interrupted by a SIGSTOP and then resumed by
+			// a SIGCONT, even if the default signal handler remains in place.
+			// This is a long-winded way of saying that we must handle EINTR
+			// here, or else the program may exit after being stopped and then
+			// resumed by a signal, a debugger, or ptrace.
+			if e, ok := err.(syscall.Errno); ok {
+				if e.Temporary() {
+					continue
+				}
+			}
 			log.Fatalf("epoll wait error: %v", err)
 		}
 		if nevents == 1 && events[0].Events&unix.EPOLLOUT == unix.EPOLLOUT {

projects/compose/compose-dynamic.yml

@@ -25,7 +25,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: ntpd
     image: linuxkit/openntpd:v0.7
   - name: docker

projects/compose/compose-static.yml

@@ -25,7 +25,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: ntpd
     image: linuxkit/openntpd:v0.7
   - name: docker

projects/ima-namespace/ima-namespace.yml

@@ -15,7 +15,7 @@ onboot:
     command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
 services:
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: nginx
     image: nginx:1.13.8-alpine
     capabilities:

projects/miragesdk/examples/fdd.yml

@@ -16,7 +16,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: dhcpcd
     image: linuxkit/dhcpcd:v0.7
 files:

projects/shiftfs/shiftfs.yml

@@ -18,7 +18,7 @@ services:
     env:
      - INSECURE=true
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: nginx
     image: nginx:1.13.8-alpine
     capabilities:

test/cases/030_security/000_docker-bench/test.yml

@@ -18,7 +18,7 @@ onboot:
     command: ["/usr/bin/mountie", "/var/lib/docker"]
 services:
   - name: rngd
-    image: linuxkit/rngd:v0.7
+    image: linuxkit/rngd:02c555b50cd1887aa628836662d2eec54c0d7e81
   - name: dhcpcd
     image: linuxkit/dhcpcd:v0.7
   - name: docker