4a6f9d2516
The RNG can't actually be seeded from a shell script, due to the reliance on ioctls. For this reason, Busybox 1.36.0 contains SeedRNG, a tiny program meant to be called at startup and shutdown (and at arbitrary other points in between if desired). Note that initially, the way seedrng was included in busybox broke things quite severely, but now it's been reverted to a reasonably acceptable version. This is a significant improvement over the current init script, which doesn't credit entropy and whose hashing in shell scripts is sort of fragile. Because seedrng is part of busybox, urandom-scripts now depends on BR2_PACKAGE_BUSYBOX. This can be removed again if later we add a standalone seedrng package. Add a decent explanation to the init script about the need for a persistent directory to make this actually work. Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com> [Arnout: - Remove busybox patch, it's now part of busybox 1.36.0. - Depend on busybox. - Fix shellcheck errors. - Use DAEMON and SEEDRNG_ARGS. - Don't bother with "seed_dir" and "skip_credit" variables. - Rename to S20seedrng. ] Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
41 lines
1.2 KiB
Bash
41 lines
1.2 KiB
Bash
#! /bin/sh
|
|
#
|
|
# Preserve the random seed between reboots. See urandom(4).
|
|
#
|
|
# This script can be called multiple times during operation (e.g. with
|
|
# "reload" argument) to refresh the seed.
|
|
|
|
# The following arguments can be added to SEEDRNG_ARGS in
|
|
# /etc/default/seedrng:
|
|
# --seed-dir=/path/to/seed/directory
|
|
# Path to the directory where the seed and the lock files are stored.
|
|
# for optimal operation, this should be a persistent, writeable
|
|
# location. Default is /var/lib/seedrng
|
|
#
|
|
# --skip-credit
|
|
# Set this to true only if you do not want seed files to actually
|
|
# credit the RNG, for example if you plan to replicate this file
|
|
# system image and do not have the wherewithal to first delete the
|
|
# contents of /var/lib/seedrng.
|
|
#
|
|
# Example:
|
|
# SEEDRNG_ARGS="--seed-dir=/data/seedrng --skip-credit"
|
|
#
|
|
|
|
DAEMON="seedrng"
|
|
SEEDRNG_ARGS=""
|
|
|
|
# shellcheck source=/dev/null
|
|
[ -r "/etc/default/$DAEMON" ] && . "/etc/default/$DAEMON"
|
|
|
|
case "$1" in
|
|
start|stop|restart|reload)
|
|
# Never fail, as this isn't worth making a fuss
|
|
# over if it doesn't go as planned.
|
|
# shellcheck disable=SC2086 # we need the word splitting
|
|
seedrng $SEEDRNG_ARGS || true;;
|
|
*)
|
|
echo "Usage: $0 {start|stop|restart|reload}"
|
|
exit 1
|
|
esac
|