aboutsummaryrefslogtreecommitdiffstats
path: root/package/base-files/files/etc
diff options
context:
space:
mode:
authorEtienne CHAMPETIER <champetier.etienne@gmail.com>2016-06-27 15:53:30 +0000
committerJohn Crispin <john@phrozen.org>2016-06-30 22:48:39 +0200
commit3946a5529132c80793a9e5ee665a3cd6b0835310 (patch)
tree5349fce52318abfb2b2750ab5df4e4acdeb37e38 /package/base-files/files/etc
parente408abd7fb8e2a8842726345f393236c53496933 (diff)
downloadupstream-3946a5529132c80793a9e5ee665a3cd6b0835310.tar.gz
upstream-3946a5529132c80793a9e5ee665a3cd6b0835310.tar.bz2
upstream-3946a5529132c80793a9e5ee665a3cd6b0835310.zip
base-files: seed /dev/urandom
This commit: 1) seed /dev/urandom with the saved seeds as early as possible (see /lib/preinit/81_urandom_seed) 2) save a seed at /etc/urandom.seed if it doesn't exists 3) save a new seed each boot at "system.@system[0].urandom_seed" (see /etc/init.d/urandom_seed) We use getrandom() so we are sure /dev/urandom pool is initialized Seed size is 512 bytes (ie /proc/sys/kernel/random/poolsize / 8) it's the same size as in ubuntu 14.04 and all systemd systems Seeding /dev/urandom doesn't change entropy estimation, so we still have "random: ubus urandom read with 4 bits of entropy available" messages in the logs, but we can now ignore them if after "urandom-seed: Seeding with ..." message Saving a new seed on each boot is disabled by default to avoid too much writes without user consent v2: log preinit messages to /dev/kmsg v3: use non generic function name for logging, as /lib/preinit/ files are all sourced together in /etc/preinit v4: after a lot of discussion on the ML, use a uci config param v5: config param is now the path of the seed Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com> Acked-by: Jo-Philipp Wich <jo@mein.io>
Diffstat (limited to 'package/base-files/files/etc')
-rwxr-xr-xpackage/base-files/files/etc/init.d/urandom_seed29
1 files changed, 29 insertions, 0 deletions
diff --git a/package/base-files/files/etc/init.d/urandom_seed b/package/base-files/files/etc/init.d/urandom_seed
new file mode 100755
index 0000000000..cb2eb444fc
--- /dev/null
+++ b/package/base-files/files/etc/init.d/urandom_seed
@@ -0,0 +1,29 @@
+#!/bin/sh /etc/rc.common
+
+START=99
+
+EXTRA_COMMANDS="save"
+
+_log() {
+ logger -t urandom_seed "$1"
+}
+
+_save() {
+ touch $1.tmp || { _log "touch $1 failed"; return; }
+ chown root:root $1.tmp || { _log "chown $1 failed"; return; }
+ chmod 600 $1.tmp || { _log "chmod $1 failed"; return; }
+ getrandom 512 > $1.tmp || { _log "getrandom failed"; return; }
+ mv $1.tmp $1 || { _log "mv $1 failed"; return; }
+}
+
+save() {
+ SEED="$(uci -q get system.@system[0].urandom_seed)"
+ [ "${SEED:0:1}" == "/" ] && _save "$SEED" && _log "Seed saved ($SEED)"
+
+ SEED=/etc/urandom.seed
+ [ ! -f $SEED ] && _save "$SEED" && _log "Seed saved ($SEED)"
+}
+
+boot() {
+ save
+}