From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH 2/2] random: Initialise the kernel's PRNG earlier
Date: Wed, 29 Apr 2020 19:33:04 +0000 [thread overview]
Message-ID: <20200429193304.21404-3-michael.tremer@ipfire.org> (raw)
In-Reply-To: <20200429193304.21404-1-michael.tremer@ipfire.org>
[-- Attachment #1: Type: text/plain, Size: 8087 bytes --]
Since more processes depend on good randomness, we need to
make sure that the kernel's PRNG is initialized as early as
possible.
For systems without a HWRNG, we will need to fall back to our
noisy loop and wait until we have enough randomness.
This patch also removes saving and restoring the seed. This
is no longer useful because the kernel's PRNG only takes any
input after it has successfully been seeded from other sources.
Hence adding this seed does not increase its randomness.
Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org>
---
config/rootfiles/common/aarch64/initscripts | 4 +---
config/rootfiles/common/armv5tel/initscripts | 4 +---
config/rootfiles/common/i586/initscripts | 4 +---
config/rootfiles/common/x86_64/initscripts | 4 +---
lfs/initscripts | 4 +---
src/initscripts/system/random | 21 +-------------------
6 files changed, 6 insertions(+), 35 deletions(-)
diff --git a/config/rootfiles/common/aarch64/initscripts b/config/rootfiles/common/aarch64/initscripts
index d6f13224a..8d945f7a5 100644
--- a/config/rootfiles/common/aarch64/initscripts
+++ b/config/rootfiles/common/aarch64/initscripts
@@ -104,7 +104,6 @@ etc/rc.d/rc0.d/K08fcron
etc/rc.d/rc0.d/K28apache
etc/rc.d/rc0.d/K30sshd
#etc/rc.d/rc0.d/K34client175
-etc/rc.d/rc0.d/K45random
etc/rc.d/rc0.d/K47setclock
etc/rc.d/rc0.d/K49cyrus-sasl
etc/rc.d/rc0.d/K51vnstat
@@ -124,7 +123,6 @@ etc/rc.d/rc0.d/S80mountfs
etc/rc.d/rc0.d/S90swap
etc/rc.d/rc0.d/S99halt
#etc/rc.d/rc3.d
-etc/rc.d/rc3.d/S00random
etc/rc.d/rc3.d/S01vnstat
etc/rc.d/rc3.d/S10sysklogd
etc/rc.d/rc3.d/S11unbound
@@ -157,7 +155,6 @@ etc/rc.d/rc6.d/K08fcron
etc/rc.d/rc6.d/K28apache
etc/rc.d/rc6.d/K30sshd
#etc/rc.d/rc6.d/K34client175
-etc/rc.d/rc6.d/K45random
etc/rc.d/rc6.d/K47setclock
etc/rc.d/rc6.d/K49cyrus-sasl
etc/rc.d/rc6.d/K51vnstat
@@ -194,6 +191,7 @@ etc/rc.d/rcsysinit.d/S45udev_retry
etc/rc.d/rcsysinit.d/S50cleanfs
etc/rc.d/rcsysinit.d/S60setclock
etc/rc.d/rcsysinit.d/S65rngd
+etc/rc.d/rcsysinit.d/S66random
etc/rc.d/rcsysinit.d/S70console
etc/rc.d/rcsysinit.d/S71pakfire
etc/rc.d/rcsysinit.d/S73swconfig
diff --git a/config/rootfiles/common/armv5tel/initscripts b/config/rootfiles/common/armv5tel/initscripts
index d6f13224a..8d945f7a5 100644
--- a/config/rootfiles/common/armv5tel/initscripts
+++ b/config/rootfiles/common/armv5tel/initscripts
@@ -104,7 +104,6 @@ etc/rc.d/rc0.d/K08fcron
etc/rc.d/rc0.d/K28apache
etc/rc.d/rc0.d/K30sshd
#etc/rc.d/rc0.d/K34client175
-etc/rc.d/rc0.d/K45random
etc/rc.d/rc0.d/K47setclock
etc/rc.d/rc0.d/K49cyrus-sasl
etc/rc.d/rc0.d/K51vnstat
@@ -124,7 +123,6 @@ etc/rc.d/rc0.d/S80mountfs
etc/rc.d/rc0.d/S90swap
etc/rc.d/rc0.d/S99halt
#etc/rc.d/rc3.d
-etc/rc.d/rc3.d/S00random
etc/rc.d/rc3.d/S01vnstat
etc/rc.d/rc3.d/S10sysklogd
etc/rc.d/rc3.d/S11unbound
@@ -157,7 +155,6 @@ etc/rc.d/rc6.d/K08fcron
etc/rc.d/rc6.d/K28apache
etc/rc.d/rc6.d/K30sshd
#etc/rc.d/rc6.d/K34client175
-etc/rc.d/rc6.d/K45random
etc/rc.d/rc6.d/K47setclock
etc/rc.d/rc6.d/K49cyrus-sasl
etc/rc.d/rc6.d/K51vnstat
@@ -194,6 +191,7 @@ etc/rc.d/rcsysinit.d/S45udev_retry
etc/rc.d/rcsysinit.d/S50cleanfs
etc/rc.d/rcsysinit.d/S60setclock
etc/rc.d/rcsysinit.d/S65rngd
+etc/rc.d/rcsysinit.d/S66random
etc/rc.d/rcsysinit.d/S70console
etc/rc.d/rcsysinit.d/S71pakfire
etc/rc.d/rcsysinit.d/S73swconfig
diff --git a/config/rootfiles/common/i586/initscripts b/config/rootfiles/common/i586/initscripts
index 2db7f1aa3..996925b7a 100644
--- a/config/rootfiles/common/i586/initscripts
+++ b/config/rootfiles/common/i586/initscripts
@@ -103,7 +103,6 @@ etc/rc.d/rc0.d/K08fcron
etc/rc.d/rc0.d/K28apache
etc/rc.d/rc0.d/K30sshd
#etc/rc.d/rc0.d/K34client175
-etc/rc.d/rc0.d/K45random
etc/rc.d/rc0.d/K47setclock
etc/rc.d/rc0.d/K49cyrus-sasl
etc/rc.d/rc0.d/K51vnstat
@@ -123,7 +122,6 @@ etc/rc.d/rc0.d/S80mountfs
etc/rc.d/rc0.d/S90swap
etc/rc.d/rc0.d/S99halt
#etc/rc.d/rc3.d
-etc/rc.d/rc3.d/S00random
etc/rc.d/rc3.d/S01vnstat
etc/rc.d/rc3.d/S10sysklogd
etc/rc.d/rc3.d/S12acpid
@@ -156,7 +154,6 @@ etc/rc.d/rc6.d/K08fcron
etc/rc.d/rc6.d/K28apache
etc/rc.d/rc6.d/K30sshd
#etc/rc.d/rc6.d/K34client175
-etc/rc.d/rc6.d/K45random
etc/rc.d/rc6.d/K47setclock
etc/rc.d/rc6.d/K49cyrus-sasl
etc/rc.d/rc6.d/K51vnstat
@@ -193,6 +190,7 @@ etc/rc.d/rcsysinit.d/S45udev_retry
etc/rc.d/rcsysinit.d/S50cleanfs
etc/rc.d/rcsysinit.d/S60setclock
etc/rc.d/rcsysinit.d/S65rngd
+etc/rc.d/rcsysinit.d/S66random
etc/rc.d/rcsysinit.d/S70console
etc/rc.d/rcsysinit.d/S71pakfire
etc/rc.d/rcsysinit.d/S74cloud-init
diff --git a/config/rootfiles/common/x86_64/initscripts b/config/rootfiles/common/x86_64/initscripts
index 2db7f1aa3..996925b7a 100644
--- a/config/rootfiles/common/x86_64/initscripts
+++ b/config/rootfiles/common/x86_64/initscripts
@@ -103,7 +103,6 @@ etc/rc.d/rc0.d/K08fcron
etc/rc.d/rc0.d/K28apache
etc/rc.d/rc0.d/K30sshd
#etc/rc.d/rc0.d/K34client175
-etc/rc.d/rc0.d/K45random
etc/rc.d/rc0.d/K47setclock
etc/rc.d/rc0.d/K49cyrus-sasl
etc/rc.d/rc0.d/K51vnstat
@@ -123,7 +122,6 @@ etc/rc.d/rc0.d/S80mountfs
etc/rc.d/rc0.d/S90swap
etc/rc.d/rc0.d/S99halt
#etc/rc.d/rc3.d
-etc/rc.d/rc3.d/S00random
etc/rc.d/rc3.d/S01vnstat
etc/rc.d/rc3.d/S10sysklogd
etc/rc.d/rc3.d/S12acpid
@@ -156,7 +154,6 @@ etc/rc.d/rc6.d/K08fcron
etc/rc.d/rc6.d/K28apache
etc/rc.d/rc6.d/K30sshd
#etc/rc.d/rc6.d/K34client175
-etc/rc.d/rc6.d/K45random
etc/rc.d/rc6.d/K47setclock
etc/rc.d/rc6.d/K49cyrus-sasl
etc/rc.d/rc6.d/K51vnstat
@@ -193,6 +190,7 @@ etc/rc.d/rcsysinit.d/S45udev_retry
etc/rc.d/rcsysinit.d/S50cleanfs
etc/rc.d/rcsysinit.d/S60setclock
etc/rc.d/rcsysinit.d/S65rngd
+etc/rc.d/rcsysinit.d/S66random
etc/rc.d/rcsysinit.d/S70console
etc/rc.d/rcsysinit.d/S71pakfire
etc/rc.d/rcsysinit.d/S74cloud-init
diff --git a/lfs/initscripts b/lfs/initscripts
index ba6c9f913..242de60e5 100644
--- a/lfs/initscripts
+++ b/lfs/initscripts
@@ -126,9 +126,6 @@ $(TARGET) :
ln -sf ../init.d/unbound /etc/rc.d/rc0.d/K86unbound
ln -sf ../init.d/unbound /etc/rc.d/rc3.d/S11unbound
ln -sf ../init.d/unbound /etc/rc.d/rc6.d/K86unbound
- ln -sf ../init.d/random /etc/rc.d/rc0.d/K45random
- ln -sf ../init.d/random /etc/rc.d/rc3.d/S00random
- ln -sf ../init.d/random /etc/rc.d/rc6.d/K45random
ln -sf ../../sysconfig/rc.local /etc/rc.d/rc3.d/S98rc.local
ln -sf ../init.d/client175 /etc/rc.d/rc0.d/K34client175
ln -sf ../init.d/client175 /etc/rc.d/rc3.d/S66client175
@@ -174,6 +171,7 @@ $(TARGET) :
ln -sf ../init.d/setclock /etc/rc.d/rc0.d/K47setclock
ln -sf ../init.d/setclock /etc/rc.d/rc6.d/K47setclock
ln -sf ../init.d/rngd /etc/rc.d/rcsysinit.d/S65rngd
+ ln -sf ../init.d/random /etc/rc.d/rcsysinit.d/S66random
ln -sf ../init.d/console /etc/rc.d/rcsysinit.d/S70console
ln -sf ../init.d/pakfire /etc/rc.d/rcsysinit.d/S71pakfire
ln -sf ../init.d/cloud-init /etc/rc.d/rcsysinit.d/S74cloud-init
diff --git a/src/initscripts/system/random b/src/initscripts/system/random
index 1f825cd18..489c7dac9 100644
--- a/src/initscripts/system/random
+++ b/src/initscripts/system/random
@@ -22,29 +22,10 @@ case "$1" in
sync
rm -f /var/tmp/random-tmpfile
done;
-
- boot_mesg "\rInitializing kernel random number generator..."
- if [ -f /var/tmp/random-seed ]; then
- /bin/cat /var/tmp/random-seed >/dev/urandom
- fi
- touch /var/tmp/random-seed
- chmod 600 /var/tmp/random-seed
- /bin/dd if=/dev/urandom of=/var/tmp/random-seed \
- count=1 bs=$poolsize &>/dev/null
- evaluate_retval
- ;;
-
- stop)
- boot_mesg "Saving random seed..."
- touch /var/tmp/random-seed
- chmod 600 /var/tmp/random-seed
- /bin/dd if=/dev/urandom of=/var/tmp/random-seed \
- count=1 bs=$poolsize &>/dev/null
- evaluate_retval
;;
*)
- echo "Usage: $0 {start|stop}"
+ echo "Usage: $0 {start}"
exit 1
;;
esac
--
2.20.1
prev parent reply other threads:[~2020-04-29 19:33 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-29 19:33 Fixing problems installing IPFire on systems without randomness Michael Tremer
2020-04-29 19:33 ` [PATCH 1/2] random: Launch rngd earlier in the boot process Michael Tremer
2020-04-29 19:33 ` Michael Tremer [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200429193304.21404-3-michael.tremer@ipfire.org \
--to=michael.tremer@ipfire.org \
--cc=development@lists.ipfire.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox