Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's
rand function instead of
/dev/urandom. And what would be a sufficiently secure seed generator?
No. The PRNG in typical C libraries is designed for speed, not for security. It's usually appropriate for numerical simulations and games (in good-quality implementations — there are implementations out there, mostly old ones, where it's not appropriate for anything), but not for cryptography. A cryptographic PRNG must be unpredictable, i.e. an attacker who generates a series of numbers must not be able to make a good guess at the next number. The typical C library PRNG strives for speed and good statistical properties but not for unpredictability.
To generate key material or any other random number involved in cryptography (including non-secret things like nonces that nonetheless need to be unpredictable), obtain all bits from a crypto-quality RNG. Linux's
/dev/urandom (or any other unix that has
/dev/urandom) is fine for that. You must use it for each byte of each key; using it as a seed of the C library PRNG is not good (there would be a strong correlation between the keys). A library such as OpenSSL is another choice; it'll probably use
/dev/urandom under the hood as a seed but may be a little faster if you're generating large volumes of random data.
rand() is totally insecure. Using
rand() for this purpose has caused major vulnerabilities in major systems.