From 6d8bc46cc0ebe75d86d00a6ee7c452beea761c42 Mon Sep 17 00:00:00 2001
From: Victor Stinner <victor.stinner@gmail.com>
Date: Tue, 20 Sep 2016 22:46:02 +0200
Subject: [PATCH] Catch EPERM error in py_getrandom()

Issue #27955: Fallback on reading /dev/urandom device when the getrandom()
syscall fails with EPERM, for example when blocked by SECCOMP.
---
 Misc/NEWS       |  3 +++
 Python/random.c | 15 ++++++++-------
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/Misc/NEWS b/Misc/NEWS
index a0dccdbd305..f5efee1d1ad 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ Release date: TBA
 Core and Builtins
 -----------------
 
+- Issue #27955: Fallback on reading /dev/urandom device when the getrandom()
+  syscall fails with EPERM, for example when blocked by SECCOMP.
+
 - Issue #28131: Fix a regression in zipimport's compile_source().  zipimport
   should use the same optimization level as the interpreter.
 
diff --git a/Python/random.c b/Python/random.c
index 5582e397145..f2ada5f0d84 100644
--- a/Python/random.c
+++ b/Python/random.c
@@ -121,8 +121,8 @@ py_getentropy(unsigned char *buffer, Py_ssize_t size, int fatal)
 
 /* Call getrandom()
    - Return 1 on success
-   - Return 0 if getrandom() syscall is not available (failed with ENOSYS)
-     or if getrandom(GRND_NONBLOCK) failed with EAGAIN (system urandom
+   - Return 0 if getrandom() syscall is not available (failed with ENOSYS or
+     EPERM) or if getrandom(GRND_NONBLOCK) failed with EAGAIN (system urandom
      not initialized yet) and raise=0.
    - Raise an exception (if raise is non-zero) and return -1 on error:
      getrandom() failed with EINTR and the Python signal handler raised an
@@ -131,7 +131,7 @@ static int
 py_getrandom(void *buffer, Py_ssize_t size, int raise)
 {
     /* Is getrandom() supported by the running kernel? Set to 0 if getrandom()
-       failed with ENOSYS. Need Linux kernel 3.17 or newer, or Solaris
+       failed with ENOSYS or EPERM. Need Linux kernel 3.17 or newer, or Solaris
        11.3 or newer */
     static int getrandom_works = 1;
 
@@ -182,8 +182,9 @@ py_getrandom(void *buffer, Py_ssize_t size, int raise)
 
         if (n < 0) {
             /* ENOSYS: getrandom() syscall not supported by the kernel (but
-             * maybe supported by the host which built Python). */
-            if (errno == ENOSYS) {
+             * maybe supported by the host which built Python). EPERM:
+             * getrandom() syscall blocked by SECCOMP or something else. */
+            if (errno == ENOSYS || errno == EPERM) {
                 getrandom_works = 0;
                 return 0;
             }
@@ -250,7 +251,7 @@ dev_urandom_noraise(unsigned char *buffer, Py_ssize_t size)
     if (py_getrandom(buffer, size, 0) == 1) {
         return;
     }
-    /* getrandom() failed with ENOSYS,
+    /* getrandom() failed with ENOSYS or EPERM,
        fall back on reading /dev/urandom */
 #endif
 
@@ -301,7 +302,7 @@ dev_urandom_python(char *buffer, Py_ssize_t size)
     if (res == 1) {
         return 0;
     }
-    /* getrandom() failed with ENOSYS,
+    /* getrandom() failed with ENOSYS or EPERM,
        fall back on reading /dev/urandom */
 #endif