Skip to content
Snippets Groups Projects
  • Etienne CHAMPETIER's avatar
    3946a552
    base-files: seed /dev/urandom · 3946a552
    Etienne CHAMPETIER authored
    
    This commit:
    1) seed /dev/urandom with the saved seeds as early as possible
       (see /lib/preinit/81_urandom_seed)
    2) save a seed at /etc/urandom.seed if it doesn't exists
    3) save a new seed each boot at "system.@system[0].urandom_seed"
       (see /etc/init.d/urandom_seed)
    
    We use getrandom() so we are sure /dev/urandom pool is initialized
    
    Seed size is 512 bytes (ie /proc/sys/kernel/random/poolsize / 8)
    it's the same size as in ubuntu 14.04 and all systemd systems
    
    Seeding /dev/urandom doesn't change entropy estimation, so we still have
    "random: ubus urandom read with 4 bits of entropy available"
    messages in the logs, but we can now ignore them if
    after "urandom-seed: Seeding with ..." message
    
    Saving a new seed on each boot is disabled by default to avoid too much
    writes without user consent
    
    v2: log preinit messages to /dev/kmsg
    v3: use non generic function name for logging, as /lib/preinit/ files
        are all sourced together in /etc/preinit
    v4: after a lot of discussion on the ML, use a uci config param
    v5: config param is now the path of the seed
    
    Signed-off-by: default avatarEtienne CHAMPETIER <champetier.etienne@gmail.com>
    Acked-by: default avatarJo-Philipp Wich <jo@mein.io>
    3946a552
    History
    base-files: seed /dev/urandom
    Etienne CHAMPETIER authored
    
    This commit:
    1) seed /dev/urandom with the saved seeds as early as possible
       (see /lib/preinit/81_urandom_seed)
    2) save a seed at /etc/urandom.seed if it doesn't exists
    3) save a new seed each boot at "system.@system[0].urandom_seed"
       (see /etc/init.d/urandom_seed)
    
    We use getrandom() so we are sure /dev/urandom pool is initialized
    
    Seed size is 512 bytes (ie /proc/sys/kernel/random/poolsize / 8)
    it's the same size as in ubuntu 14.04 and all systemd systems
    
    Seeding /dev/urandom doesn't change entropy estimation, so we still have
    "random: ubus urandom read with 4 bits of entropy available"
    messages in the logs, but we can now ignore them if
    after "urandom-seed: Seeding with ..." message
    
    Saving a new seed on each boot is disabled by default to avoid too much
    writes without user consent
    
    v2: log preinit messages to /dev/kmsg
    v3: use non generic function name for logging, as /lib/preinit/ files
        are all sourced together in /etc/preinit
    v4: after a lot of discussion on the ML, use a uci config param
    v5: config param is now the path of the seed
    
    Signed-off-by: default avatarEtienne CHAMPETIER <champetier.etienne@gmail.com>
    Acked-by: default avatarJo-Philipp Wich <jo@mein.io>