This commit: 1) seed /dev/urandom with the saved seeds as early as possible (see /lib/preinit/81_urandom_seed) 2) save a seed at /etc/urandom.seed if it doesn't exists 3) save a new seed each boot at "system.@system[0].urandom_seed" (see /etc/init.d/urandom_seed) We use getrandom() so we are sure /dev/urandom pool is initialized Seed size is 512 bytes (ie /proc/sys/kernel/random/poolsize / 8) it's the same size as in ubuntu 14.04 and all systemd systems Seeding /dev/urandom doesn't change entropy estimation, so we still have "random: ubus urandom read with 4 bits of entropy available" messages in the logs, but we can now ignore them if after "urandom-seed: Seeding with ..." message Saving a new seed on each boot is disabled by default to avoid too much writes without user consent v2: log preinit messages to /dev/kmsg v3: use non generic function name for logging, as /lib/preinit/ files are all sourced together in /etc/preinit v4: after a lot of discussion on the ML, use a uci config param v5: config param is now the path of the seed Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com> Acked-by: Jo-Philipp Wich <jo@mein.io>master
parent
e408abd7fb
commit
3946a55291
@ -0,0 +1,29 @@ |
||||
#!/bin/sh /etc/rc.common |
||||
|
||||
START=99 |
||||
|
||||
EXTRA_COMMANDS="save" |
||||
|
||||
_log() { |
||||
logger -t urandom_seed "$1" |
||||
} |
||||
|
||||
_save() { |
||||
touch $1.tmp || { _log "touch $1 failed"; return; } |
||||
chown root:root $1.tmp || { _log "chown $1 failed"; return; } |
||||
chmod 600 $1.tmp || { _log "chmod $1 failed"; return; } |
||||
getrandom 512 > $1.tmp || { _log "getrandom failed"; return; } |
||||
mv $1.tmp $1 || { _log "mv $1 failed"; return; } |
||||
} |
||||
|
||||
save() { |
||||
SEED="$(uci -q get system.@system[0].urandom_seed)" |
||||
[ "${SEED:0:1}" == "/" ] && _save "$SEED" && _log "Seed saved ($SEED)" |
||||
|
||||
SEED=/etc/urandom.seed |
||||
[ ! -f $SEED ] && _save "$SEED" && _log "Seed saved ($SEED)" |
||||
} |
||||
|
||||
boot() { |
||||
save |
||||
} |
@ -0,0 +1,24 @@ |
||||
#!/bin/sh |
||||
|
||||
log_urandom_seed() { |
||||
echo "urandom-seed: $1" > /dev/kmsg |
||||
} |
||||
|
||||
_do_urandom_seed() { |
||||
[ -f "$1" ] || { log_urandom_seed "Seed file not found ($1)"; return; } |
||||
[ -O "$1" -a -G "$1" -a ! -x "$1" ] || { log_urandom_seed "Wrong owner / permissions for $1"; return; } |
||||
|
||||
log_urandom_seed "Seeding with $1" |
||||
cat "$1" > /dev/urandom |
||||
} |
||||
|
||||
do_urandom_seed() { |
||||
[ -c /dev/urandom ] || { log_urandom_seed "Something is wrong with /dev/urandom"; return; } |
||||
|
||||
_do_urandom_seed "/etc/urandom.seed" |
||||
|
||||
SEED="$(uci -q get system.@system[0].urandom_seed)" |
||||
[ "${SEED:0:1}" == "/" -a "$SEED" != "/etc/urandom.seed" ] && _do_urandom_seed "$SEED" |
||||
} |
||||
|
||||
boot_hook_add preinit_main do_urandom_seed |
Loading…
Reference in new issue