[LEDE-DEV] [PATCH v4] base-files: seed /dev/urandom

[John Crispin]

On 16/06/2016 11:38, Etienne CHAMPETIER wrote:
> This commit:
> 1) seed /dev/urandom with a saved seed as early as possible
>    (see /lib/preinit/81_urandom_seed)
> 2) save a new seed if system. at system[0].write_urandom_seed_on_boot == 1
>    or if none exists. We use getrandom() so we are sure /dev/urandom
>    pool is initialized (see /etc/init.d/urandom_seed)
> 
> seed size is 512 bytes (ie /proc/sys/kernel/random/poolsize / 8)
> it's the same size as in ubuntu 14.04 and all systemd systems
> 
> seed file is /etc/urandom.seed (need a writable path)
> 
> seeding /dev/urandom doesn't change entropy estimation, so we still have
> "random: ubus urandom read with 4 bits of entropy available"
> messages in the logs, but we can now ignore them if
> after "urandom-seed: Seeding with ..." message
> 
> for now saving a new seed is disabled by default as Felix and John
> are concerned we might write too much and destroy the flash
> 
> v2: log preinit messages to /dev/kmsg
> v3: use non generic function name for logging, as /lib/preinit/ files
>     are all sourced together in /etc/preinit
> v4: after a lot of discussion on the ML, use a config param
> 
> Signed-off-by: Etienne CHAMPETIER <champetier.etienne at gmail.com>
> ---
>  package/base-files/files/bin/config_generate       |  1 +
>  package/base-files/files/etc/init.d/urandom_seed   | 28 ++++++++++++++++++++++
>  .../base-files/files/lib/preinit/81_urandom_seed   | 19 +++++++++++++++
>  3 files changed, 48 insertions(+)
>  create mode 100755 package/base-files/files/etc/init.d/urandom_seed
>  create mode 100644 package/base-files/files/lib/preinit/81_urandom_seed
> 
> diff --git a/package/base-files/files/bin/config_generate b/package/base-files/files/bin/config_generate
> index 8002bc4..9bccead 100755
> --- a/package/base-files/files/bin/config_generate
> +++ b/package/base-files/files/bin/config_generate
> @@ -230,6 +230,7 @@ generate_static_system() {
>  		set system. at system[-1].timezone='UTC'
>  		set system. at system[-1].ttylogin='0'
>  		set system. at system[-1].log_size='64'
> +		set system. at system[-1].write_urandom_seed_on_boot='0'
>  
>  		delete system.ntp
>  		set system.ntp='timeserver'
> diff --git a/package/base-files/files/etc/init.d/urandom_seed b/package/base-files/files/etc/init.d/urandom_seed
> new file mode 100755
> index 0000000..f950685
> --- /dev/null
> +++ b/package/base-files/files/etc/init.d/urandom_seed
> @@ -0,0 +1,28 @@
> +#!/bin/sh /etc/rc.common
> +
> +START=99
> +
> +EXTRA_COMMANDS="save"
> +
> +SEED=/etc/urandom.seed
> +
> +error_exit() {
> +    logger -t urandom_seed "$1"
> +    exit 1
> +}
> +
> +save() {
> +    touch $SEED.tmp || error_exit "touch failed"
> +    chown root:root $SEED.tmp || error_exit "chown failed"
> +    chmod 600 $SEED.tmp || error_exit "chmod failed"
> +    getrandom 512 > $SEED.tmp || error_exit "getrandom failed"
> +    mv $SEED.tmp $SEED || error_exit "mv failed"
> +}
> +
> +boot() {
> +    [ -f $SEED ] || {
> +        save
> +        exit 0
> +    }
> +    [ "$(uci get system. at system[0].write_urandom_seed_on_boot)" == "1" ] && save
> +}

write_urandom_seed_on_boot was a placeholder for what the option should
be named as i could not think of a good one ;) please try to find a
shorter one

	John



> diff --git a/package/base-files/files/lib/preinit/81_urandom_seed b/package/base-files/files/lib/preinit/81_urandom_seed
> new file mode 100644
> index 0000000..a1457aa
> --- /dev/null
> +++ b/package/base-files/files/lib/preinit/81_urandom_seed
> @@ -0,0 +1,19 @@
> +#!/bin/sh
> +
> +log_urandom_seed() {
> +    echo "urandom-seed: $1" > /dev/kmsg
> +}
> +
> +do_urandom_seed() {
> +    S=/etc/urandom.seed
> +    U=/dev/urandom
> +
> +    [ -c $U ] || { log_urandom_seed "Something is wrong with $U"; return; }
> +    [ -f $S ] || { log_urandom_seed "Seed file not found ($S)"; return; }
> +    [ -O $S -a -G $S -a ! -x $S ] || { log_urandom_seed "Wrong owner / permissions for $S"; return; }
> +
> +    log_urandom_seed "Seeding with $S"
> +    cat $S > $U
> +}
> +
> +boot_hook_add preinit_main do_urandom_seed
>