Marcus Meissner
ceb24846e7
tested boot-on-cryptoroot OBS-URL: https://build.opensuse.org/package/show/Base:System/systemd?expand=0&rev=920
156 lines
6.7 KiB
Diff
156 lines
6.7 KiB
Diff
Simply writing /var/lib/systemd/random-seed back to /dev/(u)random does not
|
|
increase the entropy bit count. Therefore use the RNDADDENTROPY ioctl to
|
|
write back the bytes and increase the entropy bit counter.
|
|
|
|
Related to bnc#892096
|
|
|
|
---
|
|
src/random-seed/random-seed.c | 71 ++++++++++++++++++++++++++++++++++++------
|
|
1 file changed, 61 insertions(+), 10 deletions(-)
|
|
|
|
Index: systemd-228/src/random-seed/random-seed.c
|
|
===================================================================
|
|
--- systemd-228.orig/src/random-seed/random-seed.c
|
|
+++ systemd-228/src/random-seed/random-seed.c
|
|
@@ -24,6 +24,8 @@
|
|
#include <string.h>
|
|
#include <sys/stat.h>
|
|
#include <unistd.h>
|
|
+#include <linux/random.h>
|
|
+#include <sys/ioctl.h>
|
|
|
|
#include "alloc-util.h"
|
|
#include "fd-util.h"
|
|
@@ -36,8 +38,8 @@
|
|
#define POOL_SIZE_MIN 512
|
|
|
|
int main(int argc, char *argv[]) {
|
|
- _cleanup_close_ int seed_fd = -1, random_fd = -1;
|
|
- _cleanup_free_ void* buf = NULL;
|
|
+ _cleanup_close_ int seed_fd = -1, random_fd = -1, entropy_fd = -1;
|
|
+ _cleanup_free_ struct rand_pool_info *entropy = NULL;
|
|
size_t buf_size = 0;
|
|
ssize_t k;
|
|
int r;
|
|
@@ -68,11 +70,12 @@ int main(int argc, char *argv[]) {
|
|
if (buf_size <= POOL_SIZE_MIN)
|
|
buf_size = POOL_SIZE_MIN;
|
|
|
|
- buf = malloc(buf_size);
|
|
- if (!buf) {
|
|
+ entropy = (struct rand_pool_info*) malloc(sizeof(struct rand_pool_info) + buf_size);
|
|
+ if (!entropy) {
|
|
r = log_oom();
|
|
goto finish;
|
|
}
|
|
+ entropy->buf_size = (typeof(entropy->buf_size)) buf_size;
|
|
|
|
r = mkdir_parents_label(RANDOM_SEED, 0755);
|
|
if (r < 0) {
|
|
@@ -86,6 +89,23 @@ int main(int argc, char *argv[]) {
|
|
|
|
if (streq(argv[1], "load")) {
|
|
|
|
+ entropy_fd = open(RANDOM_SEED_DIR "entropy_count", O_RDONLY|O_CLOEXEC|O_NOCTTY, 0600);
|
|
+ if (entropy_fd < 0) {
|
|
+ entropy->entropy_count = 0;
|
|
+ if (errno != ENOENT) {
|
|
+ log_error("Failed to open " RANDOM_SEED "/entropy_count: %m");
|
|
+ r = -errno;
|
|
+ goto finish;
|
|
+ }
|
|
+ } else {
|
|
+ r = read(entropy_fd, &entropy->entropy_count, sizeof(entropy->entropy_count));
|
|
+ if (r < 0) {
|
|
+ log_error("Failed to read entropy count file: %m");
|
|
+ r = -errno;
|
|
+ goto finish;
|
|
+ }
|
|
+ }
|
|
+
|
|
seed_fd = open(RANDOM_SEED, O_RDWR|O_CLOEXEC|O_NOCTTY|O_CREAT, 0600);
|
|
if (seed_fd < 0) {
|
|
seed_fd = open(RANDOM_SEED, O_RDONLY|O_CLOEXEC|O_NOCTTY);
|
|
@@ -106,7 +126,7 @@ int main(int argc, char *argv[]) {
|
|
}
|
|
}
|
|
|
|
- k = loop_read(seed_fd, buf, buf_size, false);
|
|
+ k = loop_read(seed_fd, entropy->buf, (size_t) entropy->buf_size, false);
|
|
if (k < 0)
|
|
r = log_error_errno(k, "Failed to read seed from " RANDOM_SEED ": %m");
|
|
else if (k == 0)
|
|
@@ -114,13 +134,29 @@ int main(int argc, char *argv[]) {
|
|
else {
|
|
(void) lseek(seed_fd, 0, SEEK_SET);
|
|
|
|
- r = loop_write(random_fd, buf, (size_t) k, false);
|
|
- if (r < 0)
|
|
- log_error_errno(r, "Failed to write seed to /dev/urandom: %m");
|
|
+ if (entropy->entropy_count && (size_t)k == (size_t)entropy->buf_size) {
|
|
+ r = ioctl(random_fd, RNDADDENTROPY, entropy);
|
|
+ if (r < 0) {
|
|
+ log_error_errno(errno, "Failed to write seed to /dev/urandom: %m");
|
|
+ r = -errno;
|
|
+ }
|
|
+ } else {
|
|
+ r = loop_write(random_fd, entropy->buf, (size_t) k, false);
|
|
+ if (r < 0)
|
|
+ log_error_errno(r, "Failed to write seed to /dev/urandom: %m");
|
|
+ }
|
|
}
|
|
|
|
} else if (streq(argv[1], "save")) {
|
|
|
|
+ /* Read available entropy count, if possible */
|
|
+ f = fopen("/proc/sys/kernel/random/entropy_avail", "re");
|
|
+ if (f) {
|
|
+ if (fscanf(f, "%d", &entropy->entropy_count) < 0)
|
|
+ entropy->entropy_count = 0;
|
|
+ fclose(f);
|
|
+ }
|
|
+
|
|
seed_fd = open(RANDOM_SEED, O_WRONLY|O_CLOEXEC|O_NOCTTY|O_CREAT, 0600);
|
|
if (seed_fd < 0) {
|
|
r = log_error_errno(errno, "Failed to open " RANDOM_SEED ": %m");
|
|
@@ -133,6 +169,21 @@ int main(int argc, char *argv[]) {
|
|
goto finish;
|
|
}
|
|
|
|
+ if (entropy->entropy_count) {
|
|
+ entropy_fd = open(RANDOM_SEED_DIR "entropy_count", O_WRONLY|O_CLOEXEC|O_NOCTTY|O_CREAT, 0600);
|
|
+ if (seed_fd < 0) {
|
|
+ log_error("Failed to open " RANDOM_SEED_DIR "entropy_count: %m");
|
|
+ r = -errno;
|
|
+ goto finish;
|
|
+ }
|
|
+ r = write(entropy_fd, &entropy->entropy_count, sizeof(entropy->entropy_count));
|
|
+ if (r < 0) {
|
|
+ log_error("Failed to write entropy count file: %m");
|
|
+ r = -errno;
|
|
+ goto finish;
|
|
+ }
|
|
+ }
|
|
+
|
|
} else {
|
|
log_error("Unknown verb '%s'.", argv[1]);
|
|
r = -EINVAL;
|
|
@@ -147,7 +198,7 @@ int main(int argc, char *argv[]) {
|
|
(void) fchmod(seed_fd, 0600);
|
|
(void) fchown(seed_fd, 0, 0);
|
|
|
|
- k = loop_read(random_fd, buf, buf_size, false);
|
|
+ k = loop_read(random_fd, entropy->buf, (size_t) entropy->buf_size, false);
|
|
if (k < 0) {
|
|
r = log_error_errno(k, "Failed to read new seed from /dev/urandom: %m");
|
|
goto finish;
|
|
@@ -158,7 +209,7 @@ int main(int argc, char *argv[]) {
|
|
goto finish;
|
|
}
|
|
|
|
- r = loop_write(seed_fd, buf, (size_t) k, false);
|
|
+ r = loop_write(seed_fd, entropy->buf, (size_t) k, false);
|
|
if (r < 0)
|
|
log_error_errno(r, "Failed to write new random seed file: %m");
|
|
}
|