Re: random() (was Re: New GUC to sample log queries)

Thomas Munro <thomas(dot)munro(at)enterprisedb(dot)com> writes:
> On Thu, Dec 27, 2018 at 3:55 PM Peter Geoghegan <pg(at)bowt(dot)ie> wrote:
>> On Wed, Dec 26, 2018 at 6:39 PM Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
>>> The point here is not to be cryptographically strong at every single
>>> place where the backend might want a random number; I think we're
>>> all agreed that we don't need that. To me, the point is to ensure that
>>> the user-accessible random sequence is kept separate from internal uses,
>>> and the potential security exposure in the new random-logging patch is
>>> what justifies getting more worried about this than we were before.

> +1, but I wonder if just separating them is enough. Is our seeding
> algorithm good enough for this new purpose? The initial seed is 100%
> predictable to a logged in user (it's made from the backend PID and
> backend start time, which we tell you), and not even that hard to
> guess from the outside, so I think Coverity's warning is an
> understatement in this case. Even if we separate the PRNG state used
> for internal stuff so that users can't clobber its seed from SQL,
> wouldn't it be possible to predict which statements will survive the
> log sampling filter given easily available information and a good
> guess at how many times random() (or whatever similar thing) has been
> called so far?

Yeah, that's a good point. Maybe we should upgrade the per-process
seed initialization to make it less predictable. I could see expending
a call of the strong RNG to contribute some more noise to the seeds
selected in InitProcessGlobals().

regards, tom lane