NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
62,251 Commits 5 Branches 387 Tags 143 MiB
Makefile 63.3%
Python 16.3%
C 9.1%
Shell 5.9%
PHP 2.7%
Other 2.3%
58559ea021
Go to file
Jason A. Donenfeld 58559ea021 package/urandom-scripts: hash old seed with new seed when saving 
Writing into /dev/urandom doesn't actually credit any entropy bits. And
while it adds that data to the entropy pool, it won't actually be
immediately used when reading from /dev/urandom subsequently. This is
how the kernel's /dev/urandom has always worked, unfortunately.

As a result of this behavior, which may be understandably surprising,
writing a good seed file into /dev/urandom and then saving a new seed
file immediately after is dangerous, because the new seed file may wind
up being entirely deterministic, even if the old seed file was quite
good.

This has been fixed in systemd with
<da2862ef06>,
and fortunately it's possible to do the same thing in shell script here.
Specifically, instead of just saving new /dev/urandom output straight
up, we hash the new /dev/urandom together with the old seed, in order to
produce the new seed. This way the amount of entropy in the new seed
will stay the same or get better, but not appreciably regress.

At the same time, the pool size check in this script is useless. Writing
to /dev/urandom never credits bits anyway, so no matter what, writing
into /dev/urandom is useful and not harmful. There's also not much of a
point in seeding with more than 256 bits, which is what the hashing
operation above produces. So this commit removes the file size check.

As a final note, while this commit improves upon the status quo by
removing a vulnerability, this shell script still does not actually
initialize the RNG like it says it does. For initialization via a seed
file, the RNDADDENTROPY ioctl must be used but there's currently no way
to do that from a shell script for now.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f0986de551)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-28 08:03:39 +02:00
arch core: introduce NORMALIZED_ARCH as non-kernel replacement for KERNEL_ARCH 2022-02-08 21:20:23 +01:00
board fix links to Technologic Systems web resources 2022-03-17 22:32:15 +01:00
boot boot/optee-os: add option to select DTC dependency 2022-03-20 19:24:01 +01:00
configs fix links to Technologic Systems web resources 2022-03-17 22:32:15 +01:00
docs docs/manual: Remove link to emdebian and replace with debian port page 2022-03-20 22:25:45 +01:00
fs fs/common.mk: use find instead of shell glob patterns 2022-03-19 19:57:25 +01:00
linux linux: bump CIP-RT kernel to version 5.10.104-cip3-rt3 2022-03-23 22:41:19 +01:00
package package/urandom-scripts: hash old seed with new seed when saving 2022-03-28 08:03:39 +02:00
support support/scripts/graph-build-time: add support for timeline graphing 2022-03-22 08:50:31 +01:00
system system/skeleton: provide run/lock directory 2022-01-12 20:38:09 +01:00
toolchain toolchain: fix gcc bug 99140 condition 2022-02-14 21:38:27 +01:00
utils utils/checkpackagelib/lib_mk.py: check CONF_OPTS 2022-03-07 23:15:46 +01:00
.clang-format .clang-format: initial import from Linux 5.15.6 2022-01-01 15:01:13 +01:00
.defconfig arch: remove support for sh64 2016-09-08 22:15:15 +02:00
.flake8 Revert ".flake8: fix check for 80/132 columns" 2021-01-02 17:38:20 +01:00
.gitignore
.gitlab-ci.yml utils/checkpackagelib/lib_sysv: run shellcheck 2022-02-06 18:27:03 +01:00
CHANGES Update for 2022.02 2022-03-08 23:08:11 +01:00
Config.in support/download: Add SFTP support 2022-01-06 09:34:05 +01:00
Config.in.legacy package/python-pycli: drop package 2022-03-07 22:57:18 +01:00
COPYING
DEVELOPERS DEVELOPERS: update email address 2022-03-26 20:25:24 +01:00
Makefile support/scripts/graph-build-time: add support for timeline graphing 2022-03-22 08:50:31 +01:00
Makefile.legacy Remove BR2_DEPRECATED 2016-10-15 23:14:45 +02:00
README docs: move the IRC channel away from Freenode 2021-05-29 22:16:23 +02:00

README 

Buildroot is a simple, efficient and easy-to-use tool to generate embedded
Linux systems through cross-compilation.

The documentation can be found in docs/manual. You can generate a text
document with 'make manual-text' and read output/docs/manual/manual.text.
Online documentation can be found at http://buildroot.org/docs.html

To build and use the buildroot stuff, do the following:

1) run 'make menuconfig'
2) select the target architecture and the packages you wish to compile
3) run 'make'
4) wait while it compiles
5) find the kernel, bootloader, root filesystem, etc. in output/images

You do not need to be root to build or run buildroot.  Have fun!

Buildroot comes with a basic configuration for a number of boards. Run
'make list-defconfigs' to view the list of provided configurations.

Please feed suggestions, bug reports, insults, and bribes back to the
buildroot mailing list: buildroot@buildroot.org
You can also find us on #buildroot on OFTC IRC.

If you would like to contribute patches, please read
https://buildroot.org/manual.html#submitting-patches