[LEDE-DEV] [PATCH v4] base-files: seed /dev/urandom

[Etienne CHAMPETIER]

This commit:
1) seed /dev/urandom with a saved seed as early as possible
   (see /lib/preinit/81_urandom_seed)
2) save a new seed if system. at system[0].write_urandom_seed_on_boot == 1
   or if none exists. We use getrandom() so we are sure /dev/urandom
   pool is initialized (see /etc/init.d/urandom_seed)

seed size is 512 bytes (ie /proc/sys/kernel/random/poolsize / 8)
it's the same size as in ubuntu 14.04 and all systemd systems

seed file is /etc/urandom.seed (need a writable path)

seeding /dev/urandom doesn't change entropy estimation, so we still have
"random: ubus urandom read with 4 bits of entropy available"
messages in the logs, but we can now ignore them if
after "urandom-seed: Seeding with ..." message

for now saving a new seed is disabled by default as Felix and John
are concerned we might write too much and destroy the flash

v2: log preinit messages to /dev/kmsg
v3: use non generic function name for logging, as /lib/preinit/ files
    are all sourced together in /etc/preinit
v4: after a lot of discussion on the ML, use a config param

Signed-off-by: Etienne CHAMPETIER <champetier.etienne at gmail.com>
---
 package/base-files/files/bin/config_generate       |  1 +
 package/base-files/files/etc/init.d/urandom_seed   | 28 ++++++++++++++++++++++
 .../base-files/files/lib/preinit/81_urandom_seed   | 19 +++++++++++++++
 3 files changed, 48 insertions(+)
 create mode 100755 package/base-files/files/etc/init.d/urandom_seed
 create mode 100644 package/base-files/files/lib/preinit/81_urandom_seed

diff --git a/package/base-files/files/bin/config_generate b/package/base-files/files/bin/config_generate
index 8002bc4..9bccead 100755
--- a/package/base-files/files/bin/config_generate
+++ b/package/base-files/files/bin/config_generate
@@ -230,6 +230,7 @@ generate_static_system() {
 		set system. at system[-1].timezone='UTC'
 		set system. at system[-1].ttylogin='0'
 		set system. at system[-1].log_size='64'
+		set system. at system[-1].write_urandom_seed_on_boot='0'
 
 		delete system.ntp
 		set system.ntp='timeserver'
diff --git a/package/base-files/files/etc/init.d/urandom_seed b/package/base-files/files/etc/init.d/urandom_seed
new file mode 100755
index 0000000..f950685
--- /dev/null
+++ b/package/base-files/files/etc/init.d/urandom_seed
@@ -0,0 +1,28 @@
+#!/bin/sh /etc/rc.common
+
+START=99
+
+EXTRA_COMMANDS="save"
+
+SEED=/etc/urandom.seed
+
+error_exit() {
+    logger -t urandom_seed "$1"
+    exit 1
+}
+
+save() {
+    touch $SEED.tmp || error_exit "touch failed"
+    chown root:root $SEED.tmp || error_exit "chown failed"
+    chmod 600 $SEED.tmp || error_exit "chmod failed"
+    getrandom 512 > $SEED.tmp || error_exit "getrandom failed"
+    mv $SEED.tmp $SEED || error_exit "mv failed"
+}
+
+boot() {
+    [ -f $SEED ] || {
+        save
+        exit 0
+    }
+    [ "$(uci get system. at system[0].write_urandom_seed_on_boot)" == "1" ] && save
+}
diff --git a/package/base-files/files/lib/preinit/81_urandom_seed b/package/base-files/files/lib/preinit/81_urandom_seed
new file mode 100644
index 0000000..a1457aa
--- /dev/null
+++ b/package/base-files/files/lib/preinit/81_urandom_seed
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+log_urandom_seed() {
+    echo "urandom-seed: $1" > /dev/kmsg
+}
+
+do_urandom_seed() {
+    S=/etc/urandom.seed
+    U=/dev/urandom
+
+    [ -c $U ] || { log_urandom_seed "Something is wrong with $U"; return; }
+    [ -f $S ] || { log_urandom_seed "Seed file not found ($S)"; return; }
+    [ -O $S -a -G $S -a ! -x $S ] || { log_urandom_seed "Wrong owner / permissions for $S"; return; }
+
+    log_urandom_seed "Seeding with $S"
+    cat $S > $U
+}
+
+boot_hook_add preinit_main do_urandom_seed
-- 
1.9.1