&quot;good CSPRNG, with a fixed 256-bit seed at process startup from &#x2F;dev&#x2F;urandom&quot; does describe a secure system.  It doesn&#x27;t take a syscall, and it&#x27;s not fake-secure.<p>The failures come when you try to seed in userspace.  Not when you use urandom to seed a standard algorithm, with no customizations.