Can you post a list of Linux capabilities haveged requires?

[trajano]

Can you post a list of Linux capabilities haveged requires? I want to set up Docker to run it with as little capabilities as possible.

[jirka-h]

Hello,

please check the systemd service file:

https://github.com/jirka-h/haveged/blob/9c0f06327e075394c77286b7a927e60fd01c0b3b/init.d/service.fedora

You need
CAP_SYS_ADMIN
capability.

Please google also for
haveged docker

There are already docker images
https://github.com/harbur/docker-haveged
https://hub.docker.com/r/sequenceiq/haveged
https://stackoverflow.com/questions/26021181/not-enough-entropy-to-support-dev-random-in-docker-containers-running-in-boot2d

I hope it helps.
Jirka

[trajano]

So it really needs CAP_SYS_ADMIN which is equivalent to privileged. I know about the docker images, there's a new feature of enabling it on Docker Swarm https://stackoverflow.com/questions/65241151/running-haveged-in-docker-swarm which I am trying to enable. Ideally I'd like to avoid CAP_SYS_ADMIN since that's full privileges. However, I think it really needs it since it accesses many different systems to get random sources.

[jirka-h]

I see. Thanks for sharing the background information.

We need

• ioctl access to the random device
• read-write access to the /proc virtual file system

According to the man page
https://man7.org/linux/man-pages/man4/random.4.html
(or check man -S4 random)

the CAP_SYS_ADMIN capability is indeed required. I'm sorry.

ioctl(2) interface
The following ioctl(2) requests are defined on file descriptors connected to either /dev/random or /dev/urandom.  All requests performed will interact with the input entropy pool impacting both /dev/random and /dev/urandom.
The CAP_SYS_ADMIN capability is required for all requests except RNDGETENTCNT.

[trajano]

@jirka-h no need to be sorry, it is justfified. Unfortunately I can't verify it in the end because docker/for-win#9853

[jirka-h]

Well, that's unfortunate.

I'm going to close it for now. Feel free to reopen it if there is some progress.