diff options
author | William Hubbs <w.d.hubbs@gmail.com> | 2022-03-30 11:15:13 -0500 |
---|---|---|
committer | William Hubbs <w.d.hubbs@gmail.com> | 2022-03-30 22:07:35 -0500 |
commit | 0fb11190fa5911f6f9c20c38e74a664826157a34 (patch) | |
tree | 29649ac0c1724e0cb7c9d9e823587fbd5798d55f /init.d | |
parent | df18158e60dc6bfe9a77ac7d1b48417f808f5b11 (diff) |
add seedrng service for Linux
This moves urandom to *bsd only and adds seedrng as a separate service
for Linux.
This fixes #510
Diffstat (limited to 'init.d')
-rw-r--r-- | init.d/Makefile | 8 | ||||
-rw-r--r-- | init.d/meson.build | 3 | ||||
-rw-r--r-- | init.d/seedrng.in | 46 | ||||
-rw-r--r-- | init.d/urandom.in | 39 |
4 files changed, 69 insertions, 27 deletions
diff --git a/init.d/Makefile b/init.d/Makefile index c97aeda9..ee227f43 100644 --- a/init.d/Makefile +++ b/init.d/Makefile @@ -3,7 +3,7 @@ include ../mk/net.mk DIR= ${INITDIR} SRCS= bootmisc.in fsck.in hostname.in local.in localmount.in loopback.in \ netmount.in osclock.in root.in savecache.in swap.in swclock.in \ - sysctl.in runsvdir.in urandom.in s6-svscan.in ${SRCS-${OS}} + sysctl.in runsvdir.in s6-svscan.in ${SRCS-${OS}} BIN= ${OBJS} # Are we installing our network scripts? @@ -16,7 +16,7 @@ include ${MK}/os.mk # Generic BSD scripts SRCS-FreeBSD= hostid.in modules.in moused.in newsyslog.in pf.in rarpd.in \ - rc-enabled.in rpcbind.in savecore.in syslogd.in + rc-enabled.in rpcbind.in savecore.in syslogd.in urandom.in # These are FreeBSD specific SRCS-FreeBSD+= adjkerntz.in devd.in dumpon.in encswap.in ipfw.in \ mixer.in nscd.in powerd.in syscons.in @@ -24,11 +24,11 @@ SRCS-FreeBSD+= adjkerntz.in devd.in dumpon.in encswap.in ipfw.in \ SRCS-Linux= agetty.in binfmt.in devfs.in cgroups.in dmesg.in hwclock.in \ consolefont.in keymaps.in killprocs.in modules.in \ mount-ro.in mtab.in numlock.in procfs.in net-online.in save-keymaps.in \ - save-termencoding.in sysfs.in termencoding.in + save-termencoding.in seedrng.in sysfs.in termencoding.in # Generic BSD scripts SRCS-NetBSD= hostid.in moused.in newsyslog.in pf.in rarpd.in rc-enabled.in \ - rpcbind.in savecore.in syslogd.in + rpcbind.in savecore.in syslogd.in urandom.in # These are NetBSD specific SRCS-NetBSD+= devdb.in swap-blk.in ttys.in wscons.in diff --git a/init.d/meson.build b/init.d/meson.build index a34f1c35..ab4b27f4 100644 --- a/init.d/meson.build +++ b/init.d/meson.build @@ -15,7 +15,6 @@ init_common = [ 'swclock.in', 'sysctl.in', 'runsvdir.in', - 'urandom.in', 's6-svscan.in', ] @@ -44,6 +43,7 @@ init_Linux = [ 'net-online.in', 'save-keymaps.in', 'save-termencoding.in', + 'seedrng.in', 'sysfs.in', 'termencoding.in', ] @@ -58,6 +58,7 @@ init_BSD = [ 'rpcbind.in', 'savecore.in', 'syslogd.in', + 'urandom.in', ] init_FreeBSD = [ diff --git a/init.d/seedrng.in b/init.d/seedrng.in new file mode 100644 index 00000000..25e9ad13 --- /dev/null +++ b/init.d/seedrng.in @@ -0,0 +1,46 @@ +#!@SBINDIR@/openrc-run +# Copyright (c) 2007-2022 The OpenRC Authors. +# See the Authors file at the top-level directory of this distribution and +# https://github.com/OpenRC/openrc/blob/HEAD/AUTHORS +# +# This file is part of OpenRC. It is subject to the license terms in +# the LICENSE file found in the top-level directory of this +# distribution and at https://github.com/OpenRC/openrc/blob/HEAD/LICENSE +# This file may not be copied, modified, propagated, or distributed +# except according to the terms contained in the LICENSE file. + +description="Initializes the random number generator." + +depend() +{ + after clock + need localmount + keyword -docker -jail -lxc -openvz -prefix -systemd-nspawn + provide urandom +} + +seedrng_options() +{ + [ -n "${lock_file}" ] && + echo "--lock-file \"${lock_file}\"" + [ -n "${seed_dir}" ] && + echo "--seed-dir \"${seed_dir}\"" + rc_yesno "${skip_credit}" && + echo "--skip-credit" +} + +start() +{ + ebegin "Seeding random number generator" + seedrng $(seedrng_options) + eend $? "Error seeding random number generator" + return 0 +} + +stop() +{ + ebegin "Saving random number generator seed" + seedrng $(seedrng_options) + eend $? "Error saving random number generator seed" + return 0 +} diff --git a/init.d/urandom.in b/init.d/urandom.in index cda431fd..8b7072c1 100644 --- a/init.d/urandom.in +++ b/init.d/urandom.in @@ -9,10 +9,7 @@ # This file may not be copied, modified, propagated, or distributed # except according to the terms contained in the LICENSE file. -export SEEDRNG_SEED_DIR="${seed_dir:-/var/lib/seedrng}" -export SEEDRNG_LOCK_FILE="${lock_file:-/var/run/seedrng.lock}" -export SEEDRNG_SKIP_CREDIT="${skip_credit:-false}" -: ${urandom_seed:=${SEEDRNG_SEED_DIR}/../misc/random-seed} +: ${urandom_seed:=${URANDOM_SEED:-/var/lib/misc/random-seed}} description="Initializes the random number generator." depend() @@ -24,35 +21,33 @@ depend() save_seed() { + local psz=1 + + if [ -e /proc/sys/kernel/random/poolsize ]; then + : $(( psz = $(cat /proc/sys/kernel/random/poolsize) / 4096 )) + fi + ( # sub shell to prevent umask pollution umask 077 - dd if=/dev/urandom of="$urandom_seed" count=1 2>/dev/null + dd if=/dev/urandom of="$urandom_seed" count=${psz} 2>/dev/null ) } start() { - if [ "$RC_UNAME" = Linux ]; then - seedrng - else - [ -c /dev/urandom ] || return - if [ -f "$urandom_seed" ]; then - ebegin "Initializing random number generator" - cat "$urandom_seed" > /dev/urandom - eend $? "Error initializing random number generator" - fi - rm -f "$urandom_seed" && save_seed + [ -c /dev/urandom ] || return + if [ -f "$urandom_seed" ]; then + ebegin "Initializing random number generator" + cat "$urandom_seed" > /dev/urandom + eend $? "Error initializing random number generator" fi + rm -f "$urandom_seed" && save_seed return 0 } stop() { - if [ "$RC_UNAME" = Linux ]; then - seedrng - else - ebegin "Saving random seed" - save_seed - eend $? "Failed to save random seed" - fi + ebegin "Saving random seed" + save_seed + eend $? "Failed to save random seed" } |