diff options
| author | Etienne CHAMPETIER <champetier.etienne@gmail.com> | 2016-06-27 15:53:30 +0000 |
|---|---|---|
| committer | John Crispin <john@phrozen.org> | 2016-06-30 22:48:39 +0200 |
| commit | 3946a5529132c80793a9e5ee665a3cd6b0835310 (patch) | |
| tree | 5349fce52318abfb2b2750ab5df4e4acdeb37e38 /package/base-files/files/bin | |
| parent | e408abd7fb8e2a8842726345f393236c53496933 (diff) | |
| download | upstream-3946a5529132c80793a9e5ee665a3cd6b0835310.tar.gz upstream-3946a5529132c80793a9e5ee665a3cd6b0835310.tar.bz2 upstream-3946a5529132c80793a9e5ee665a3cd6b0835310.zip | |
base-files: seed /dev/urandom
This commit:
1) seed /dev/urandom with the saved seeds as early as possible
(see /lib/preinit/81_urandom_seed)
2) save a seed at /etc/urandom.seed if it doesn't exists
3) save a new seed each boot at "system.@system[0].urandom_seed"
(see /etc/init.d/urandom_seed)
We use getrandom() so we are sure /dev/urandom pool is initialized
Seed size is 512 bytes (ie /proc/sys/kernel/random/poolsize / 8)
it's the same size as in ubuntu 14.04 and all systemd systems
Seeding /dev/urandom doesn't change entropy estimation, so we still have
"random: ubus urandom read with 4 bits of entropy available"
messages in the logs, but we can now ignore them if
after "urandom-seed: Seeding with ..." message
Saving a new seed on each boot is disabled by default to avoid too much
writes without user consent
v2: log preinit messages to /dev/kmsg
v3: use non generic function name for logging, as /lib/preinit/ files
are all sourced together in /etc/preinit
v4: after a lot of discussion on the ML, use a uci config param
v5: config param is now the path of the seed
Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com>
Acked-by: Jo-Philipp Wich <jo@mein.io>
Diffstat (limited to 'package/base-files/files/bin')
| -rwxr-xr-x | package/base-files/files/bin/config_generate | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/package/base-files/files/bin/config_generate b/package/base-files/files/bin/config_generate index 22cc1571aa..7f34eec881 100755 --- a/package/base-files/files/bin/config_generate +++ b/package/base-files/files/bin/config_generate @@ -230,6 +230,7 @@ generate_static_system() { set system.@system[-1].timezone='UTC' set system.@system[-1].ttylogin='0' set system.@system[-1].log_size='64' + set system.@system[-1].urandom_seed='0' delete system.ntp set system.ntp='timeserver' |