3946a55291
This commit:
1) seed /dev/urandom with the saved seeds as early as possible
(see /lib/preinit/81_urandom_seed)
2) save a seed at /etc/urandom.seed if it doesn't exists
3) save a new seed each boot at "system.@system[0].urandom_seed"
(see /etc/init.d/urandom_seed)
We use getrandom() so we are sure /dev/urandom pool is initialized
Seed size is 512 bytes (ie /proc/sys/kernel/random/poolsize / 8)
it's the same size as in ubuntu 14.04 and all systemd systems
Seeding /dev/urandom doesn't change entropy estimation, so we still have
"random: ubus urandom read with 4 bits of entropy available"
messages in the logs, but we can now ignore them if
after "urandom-seed: Seeding with ..." message
Saving a new seed on each boot is disabled by default to avoid too much
writes without user consent
v2: log preinit messages to /dev/kmsg
v3: use non generic function name for logging, as /lib/preinit/ files
are all sourced together in /etc/preinit
v4: after a lot of discussion on the ML, use a uci config param
v5: config param is now the path of the seed
Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
Acked-by: Jo-Philipp Wich <jo@mein.io>
29 lines
674 B
Bash
Executable file
29 lines
674 B
Bash
Executable file
#!/bin/sh /etc/rc.common
|
|
|
|
START=99
|
|
|
|
EXTRA_COMMANDS="save"
|
|
|
|
_log() {
|
|
logger -t urandom_seed "$1"
|
|
}
|
|
|
|
_save() {
|
|
touch $1.tmp || { _log "touch $1 failed"; return; }
|
|
chown root:root $1.tmp || { _log "chown $1 failed"; return; }
|
|
chmod 600 $1.tmp || { _log "chmod $1 failed"; return; }
|
|
getrandom 512 > $1.tmp || { _log "getrandom failed"; return; }
|
|
mv $1.tmp $1 || { _log "mv $1 failed"; return; }
|
|
}
|
|
|
|
save() {
|
|
SEED="$(uci -q get system.@system[0].urandom_seed)"
|
|
[ "${SEED:0:1}" == "/" ] && _save "$SEED" && _log "Seed saved ($SEED)"
|
|
|
|
SEED=/etc/urandom.seed
|
|
[ ! -f $SEED ] && _save "$SEED" && _log "Seed saved ($SEED)"
|
|
}
|
|
|
|
boot() {
|
|
save
|
|
}
|