gh-153400: Fall back to __NR_getrandom when SYS_getrandom is unavailable by jjhelmus · Pull Request #155762 · python/cpython

jjhelmus · 2026-08-13T22:24:36Z

Fall back to the kernel-provided __NR_getrandom in configure checks, os.getrandom(), and interpreter entropy handling when libc SYS_getrandom is not available.

This makes os.getrandom() available when building against an older glibc that was itself built with kernel headers lacking the syscall, provided the current kernel headers define __NR_getrandom. This type of build is done in python-build-standalone, astral-sh/python-build-standalone#1188.

Issue: Resolve newer Linux os functions at runtime instead of compiling them out against old glibc #153400

Replace libc's SYS_getrandom with the kernel-provided __NR_getrandom in configure checks, os.getrandom(), and interpreter entropy handling.

aisk · 2026-08-14T05:10:35Z

Hi, I think this is not a trivial change, so the related issue is required.

picnixz · 2026-08-14T14:30:47Z

We changed to use the glibc-provided one in #155518 so I'm nt sure this change is needed anymore but maybe there is a world where neither glibc getrandom() exists nor SYS_getrandom in which case we need to fall back to __NR_getrandom.

cc @vstinner

vstinner

In the commit message, you can document that __NR_getrandom comes from Linux kernel <unistd.h>, whereas SYS_getrandom comes from glibc <sys/syscall.h>.

vstinner · 2026-08-14T14:35:26Z

 #  endif
 #  if !defined(HAVE_GETRANDOM) && defined(HAVE_GETRANDOM_SYSCALL)
-#    include <sys/syscall.h>      // SYS_getrandom
+#    include <sys/syscall.h>      // __NR_getrandom


This include should be removed, __NR_getrandom comes from <unistd.h> which is already included above.

__NR_getrandom comes the kernel header files, like /usr/include/asm/unistd_64.h on my Fedora 44. <sys/syscall.h> is the glibc header file which provides SYS_getrandom constant, but this change replace __NR_getrandom with SYS_getrandom.

I think the chain for __NR_getrandom is <sys/syscall.h> -> <asm/unistd.h>

For SYS_getrandom, <sys/syscall.h> -> <bits/syscall.h>

I could not find a path from <unistd.h> to either of these symbols.

vstinner · 2026-08-14T14:37:09Z

 [
  AC_LANG_SOURCE([[
    #include <stddef.h>
    #include <unistd.h>


Suggested change

#include <unistd.h> // __NR_getrandom

vstinner · 2026-08-14T14:37:11Z

  AC_LANG_SOURCE([[
    #include <stddef.h>
    #include <unistd.h>
    #include <sys/syscall.h>


Since SYS_getrandom is no longer used, <sys/syscall.h> include can be removed, no?

With the change to falling back to __NR_getrandom only when SYS_getrandom is undefined this is include is still needed.

vstinner · 2026-08-14T14:37:20Z

Suggested change

#include <linux/random.h> // GRND_NONBLOCK

vstinner · 2026-08-14T14:41:11Z

I don't know how Solaris, FreeBSD and OpenBSD expose their syscall numberes: __NR_getrandom or SYS_getrandom? The PR should be tested on these systems before being merged.

jjhelmus · 2026-08-14T14:41:37Z

We changed to use the glibc-provided one in #155518 so I'm nt sure this change is needed anymore but maybe there is a world where neither glibc getrandom() exists nor SYS_getrandom in which case we need to fall back to __NR_getrandom.

This is exactly the case that python-build-standalone is running into on x86-64. The target is glibc 2.17 which does not included getrandom and the Debian package providing it is built against a a kernel that does not include SYS_getrandom. The build uses a modern UAPI kernel heads so __NR_getrandom is available.

vstinner · 2026-08-14T14:42:25Z

This makes os.getrandom() available when building against an older glibc that was itself built with kernel headers lacking the syscall, provided the current kernel headers define __NR_getrandom.

Do you mean that glibc 2.17 doesn't provide SYS_getrandom macro?

vstinner · 2026-08-14T14:43:13Z

This is exactly the case that python-build-standalone is running into on x86-64. The target is glibc 2.17 which does not included getrandom and the Debian package providing it is built against a a kernel that does not include SYS_getrandom. The build uses a modern UAPI kernel heads so __NR_getrandom is available.

Which Linux kernel version are you used to build Python?

jjhelmus · 2026-08-14T14:53:48Z

Do you mean that glibc 2.17 doesn't provide SYS_getrandom macro?

Often not, glibc 2.17 was released in 2012. The the getrandom syscall was added to the kernel in 2014 with 3.17.
glibc generates syscall aliases from the kernel headers available when it is build, so if built against <3.17, the SYS_getrandom macro will not be included.

The specifics for python-build-standalone are glibc 2.19 build against kernel 3.16. So no getrandom function nor SYS_getrandom macro. Modern 7.0 UAPI kernel headers are used in the build so __NR_getrandom is available.

Note that the glib 2.17 packages in RHEL 9 and derivates likely include the macro because the syscall list was updated to include calls from the 5.4 kernel.

vstinner · 2026-08-14T16:36:38Z

Modern 7.0 UAPI kernel headers are used in the build so __NR_getrandom is available.

I don't know "UAPI kernel headers". How do they work?

picnixz · 2026-08-14T16:39:50Z

If we want to maximize compatibility I think we should rather check for both SYS_* and __NR_* macros then. Since we're anyway worrying about exotic platforms, we may even have the lack of __NR_* macro and getrandom() syscall and only the SYS_* macro.

jjhelmus · 2026-08-14T19:39:39Z

I don't know "UAPI kernel headers". How do they work?

By UAPI headers, I mean the Linux kernel’s userspace API headers, the headers needed to compile userspace programs including CPython. These are distinct from the headers used to compile external kernel modules. On Debian, the userspace headers are provided by linux-libc-dev, while kernel-module development headers are provided by linux-headers-*. On Fedora and RHEL, the corresponding packages are kernel-headers and kernel-devel. This may not be the typical terminology used, the split is new to me.

python-build-standalone installs these header from Linux 7.0.12 and places them before the sysroot headers in the search path. Consequently, newer kernel syscall numbers such as __NR_getrandom are available at build time even when the older glibc headers do not define SYS_getrandom. More details are in astral-sh/python-build-standalone#1163.

Use the libc-provided SYS_getrandom syscall number when available, falling back to the kernel-provided __NR_getrandom when necessary.

jjhelmus · 2026-08-14T19:47:21Z

If we want to maximize compatibility I think we should rather check for both SYS_* and __NR_* macros then. Since we're anyway worrying about exotic platforms, we may even have the lack of __NR_* macro and getrandom() syscall and only the SYS_* macro.

Agreed. I'ved update the PR to use __NR_getrandom as a fallback when SYS_getrandom is undefined. This allows any of the three possibilities, getrandom(), SYS_getrandom, or __NR_getrandom to be used.

Use kernel-provided __NR_getrandom syscall number

1ad2c5d

Replace libc's SYS_getrandom with the kernel-provided __NR_getrandom in configure checks, os.getrandom(), and interpreter entropy handling.

jjhelmus requested review from AA-Turner, corona10, emmatyping, erlend-aasland and itamaro as code owners August 13, 2026 22:24

bedevere-app Bot added the awaiting review label Aug 13, 2026

jjhelmus mentioned this pull request Aug 13, 2026

Resolve newer Linux os functions at runtime instead of compiling them out against old glibc #153400

Closed

picnixz changed the title ~~Use kernel-provided __NR_getrandom syscall number~~ gh-153400: Use kernel-provided __NR_getrandom syscall number Aug 14, 2026

vstinner reviewed Aug 14, 2026

View reviewed changes

Prefer SYS_getrandom with __NR_getrandom fallback

5748e10

Use the libc-provided SYS_getrandom syscall number when available, falling back to the kernel-provided __NR_getrandom when necessary.

jjhelmus changed the title ~~gh-153400: Use kernel-provided __NR_getrandom syscall number~~ gh-153400: Fall back to __NR_getrandom when SYS_getrandom is unavailable Aug 14, 2026

jjhelmus added 2 commits August 14, 2026 15:14

Merge branch 'main' into getrandom_use_NR

88d9da8

Document GRND_NONBLOCK dependency in getrandom check

d17f8b7

Uh oh!

Uh oh!

Conversation

jjhelmus commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aisk commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

picnixz commented Aug 14, 2026

Uh oh!

vstinner left a comment

Choose a reason for hiding this comment

Uh oh!

vstinner Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

jjhelmus Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

vstinner Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

vstinner Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

jjhelmus Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

vstinner Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

vstinner commented Aug 14, 2026

Uh oh!

jjhelmus commented Aug 14, 2026

Uh oh!

vstinner commented Aug 14, 2026

Uh oh!

vstinner commented Aug 14, 2026

Uh oh!

jjhelmus commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vstinner commented Aug 14, 2026

Uh oh!

picnixz commented Aug 14, 2026

Uh oh!

jjhelmus commented Aug 14, 2026

Uh oh!

jjhelmus commented Aug 14, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jjhelmus commented Aug 13, 2026 •

edited

Loading

aisk commented Aug 14, 2026 •

edited

Loading

jjhelmus commented Aug 14, 2026 •

edited

Loading