getrandom

getrandom is a Linux system call that provides user-space programs with random bytes drawn from the kernel’s entropy pool. It offers a direct interface to the kernel’s cryptographic random number generator without requiring access to device files such as /dev/random or /dev/urandom.

Overview and usage

The function is exposed as int getrandom(void *buf, size_t buflen, unsigned int flags). It attempts to copy up to buflen bytes into the buffer pointed to by buf and returns the number of bytes actually placed. On error, it returns -1 and sets errno accordingly. The call can be interrupted or partially succeed, so programs often loop to obtain the full requested amount.

Flags

Two flags may be combined with the call: GRND_NONBLOCK and GRND_RANDOM. GRND_NONBLOCK requests non-blocking behavior; if there is not enough entropy available to satisfy the request, the call fails with errno set to EAGAIN. GRND_RANDOM selects the non-blocking random pool (often aligned with the behavior of /dev/urandom) and may return data even if the entropy pool is not fully initialized. Without GRND_RANDOM, getrandom follows the blocking semantics of the kernel’s entropy pool, which can block until sufficient entropy is available.

Portability and usage

getrandom is Linux-specific and is not guaranteed to be portable to other operating systems. In Linux environments, it is commonly used directly or via libc wrappers in modern software to obtain cryptographically strong randomness efficiently and without accessing device files.

Security and semantics

The call relies on the kernel’s entropy sources, which are designed to be cryptographically secure. getrandom is favored for reducing blocking and improving robustness of randomness provisioning, particularly during process startup and within cryptographic libraries. Proper error handling and, if necessary, looping to read the full requested amount are recommended.