title: Is a secret token generated with /dev/urandom a good way to protect a daemon?
body: <p>I have a daemon process which spawns subprocesses. Sometimes these subprocesses need to communicate back to the daemon. I want to ensure that only these subprocesses are authorized to communicate with the daemon.</p>
  
  <p>I want to implement this as follows:</p>
  
  <ul>
  <li>During startup, the daemon generates a random 128-byte secret token by reading /dev/urandom. /dev/random is no good because it may block the reader for an arbitrary amount of time.</li>
  <li>The daemon listens on a Unix domain socket.</li>
  <li>The daemon puts the secret token and the filename of the socket in environment variables. Every subprocess that it spawns can connect to the daemon using the filename and the secret token.</li>
  <li>The daemon rejects the connection unless the secret token is correct.</li>
  </ul>
  
  <p>Questions:</p>
  
  <ul>
  <li>I know that /dev/random has higher entropy than /dev/urandom. But is /dev/urandom good enough? If not, what should I use?</li>
  <li>Is the size of the token large enough?</li>
  <li>Should I lock the memory in which the token is stored? I don't think it's necessary because the daemon generates a different token every time it's started, so by the time an attacker manages to steal the hard drive and extract the token from the swap file, it should already be useless.</li>
  <li>Should I nullify the memory in which the token is stored during shutdown?</li>
  <li>Anything else I should do?</li>
  </ul>
  
  <p>And because of various requirements, I cannot use anonymous pipes to allow communication between the daemon and subprocesses.</p>