difos/package/system/urandom-seed/files/lib/preinit/81_urandom_seed

log_urandom_seed() {
    echo "urandom-seed: $1" > /dev/kmsg
}

do_urandom_seed() {
    [ -c /dev/urandom ] || { log_urandom_seed "Something is wrong with /dev/urandom"; return; }
    seedrng 2>&1 | while read -r line; do
        log_urandom_seed "$line"
    done
}

boot_hook_add preinit_main do_urandom_seed
base-files: seed /dev/urandom This commit: 1) seed /dev/urandom with the saved seeds as early as possible (see /lib/preinit/81_urandom_seed) 2) save a seed at /etc/urandom.seed if it doesn't exists 3) save a new seed each boot at "system.@system[0].urandom_seed" (see /etc/init.d/urandom_seed) We use getrandom() so we are sure /dev/urandom pool is initialized Seed size is 512 bytes (ie /proc/sys/kernel/random/poolsize / 8) it's the same size as in ubuntu 14.04 and all systemd systems Seeding /dev/urandom doesn't change entropy estimation, so we still have "random: ubus urandom read with 4 bits of entropy available" messages in the logs, but we can now ignore them if after "urandom-seed: Seeding with ..." message Saving a new seed on each boot is disabled by default to avoid too much writes without user consent v2: log preinit messages to /dev/kmsg v3: use non generic function name for logging, as /lib/preinit/ files are all sourced together in /etc/preinit v4: after a lot of discussion on the ML, use a uci config param v5: config param is now the path of the seed Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com> Acked-by: Jo-Philipp Wich <jo@mein.io> 2016-06-27 15:53:30 +00:00			`log_urandom_seed() {`
			`echo "urandom-seed: $1" > /dev/kmsg`
			`}`

			`do_urandom_seed() {`
			`[ -c /dev/urandom ] \|\| { log_urandom_seed "Something is wrong with /dev/urandom"; return; }`
urandom-seed: use seedrng for seeding the random number generator The RNG can't actually be seeded from a shell script, due to the reliance on ioctls. For this reason, the seedrng project provides a basic script meant to be copy and pasted into projects like OpenWRT and tweaked as needed: <https://git.zx2c4.com/seedrng/about/>. This commit imports it into the urandom-seed package and wires up the init scripts to call it. This also is a significant improvement over the current init script, which does not robustly handle cleaning up of seeds and syncing to prevent reuse. Additionally, the existing script creates a new seed immediately after writing an old one, which means that the amount of entropy might actually regress, due to failing to credit the old seed. Closes: https://github.com/openwrt/openwrt/issues/9570 Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> Signed-off-by: Petr Štetiar <ynezz@true.cz> [fixed missing INSTALL_DIR] 2022-03-28 04:25:56 +00:00			`seedrng 2>&1 \| while read -r line; do`
			`log_urandom_seed "$line"`
			`done`
base-files: seed /dev/urandom This commit: 1) seed /dev/urandom with the saved seeds as early as possible (see /lib/preinit/81_urandom_seed) 2) save a seed at /etc/urandom.seed if it doesn't exists 3) save a new seed each boot at "system.@system[0].urandom_seed" (see /etc/init.d/urandom_seed) We use getrandom() so we are sure /dev/urandom pool is initialized Seed size is 512 bytes (ie /proc/sys/kernel/random/poolsize / 8) it's the same size as in ubuntu 14.04 and all systemd systems Seeding /dev/urandom doesn't change entropy estimation, so we still have "random: ubus urandom read with 4 bits of entropy available" messages in the logs, but we can now ignore them if after "urandom-seed: Seeding with ..." message Saving a new seed on each boot is disabled by default to avoid too much writes without user consent v2: log preinit messages to /dev/kmsg v3: use non generic function name for logging, as /lib/preinit/ files are all sourced together in /etc/preinit v4: after a lot of discussion on the ML, use a uci config param v5: config param is now the path of the seed Signed-off-by: Etienne CHAMPETIER <champetier.etienne@gmail.com> Acked-by: Jo-Philipp Wich <jo@mein.io> 2016-06-27 15:53:30 +00:00			`}`

			`boot_hook_add preinit_main do_urandom_seed`