systemd/use-rndaddentropy-ioctl-to-load-random-seed.patch

Simply writing /var/lib/systemd/random-seed back to /dev/(u)random does not
increase the entropy bit count.  Therefore use the RNDADDENTROPY ioctl to
write back the bytes and increase the entropy bit counter.

Related to bnc#892096

---
 src/random-seed/random-seed.c |   71 ++++++++++++++++++++++++++++++++++++------
 1 file changed, 61 insertions(+), 10 deletions(-)

Index: systemd-221/src/random-seed/random-seed.c
===================================================================
--- systemd-221.orig/src/random-seed/random-seed.c
+++ systemd-221/src/random-seed/random-seed.c
@@ -22,7 +22,9 @@
 #include <unistd.h>
 #include <fcntl.h>
 #include <errno.h>
+#include <linux/random.h>
 #include <string.h>
+#include <sys/ioctl.h>
 #include <sys/stat.h>
 
 #include "log.h"
@@ -32,8 +34,8 @@
 #define POOL_SIZE_MIN 512
 
 int main(int argc, char *argv[]) {
-        _cleanup_close_ int seed_fd = -1, random_fd = -1;
-        _cleanup_free_ void* buf = NULL;
+        _cleanup_close_ int seed_fd = -1, random_fd = -1, entropy_fd = -1;
+        _cleanup_free_ struct rand_pool_info *entropy = NULL;
         size_t buf_size = 0;
         ssize_t k;
         int r;
@@ -65,11 +67,12 @@ int main(int argc, char *argv[]) {
         if (buf_size <= POOL_SIZE_MIN)
                 buf_size = POOL_SIZE_MIN;
 
-        buf = malloc(buf_size);
-        if (!buf) {
+        entropy = malloc(sizeof(struct rand_pool_info) + buf_size);
+        if (!entropy) {
                 r = log_oom();
                 goto finish;
         }
+        entropy->buf_size = buf_size;
 
         r = mkdir_parents_label(RANDOM_SEED, 0755);
         if (r < 0) {
@@ -83,6 +86,23 @@ int main(int argc, char *argv[]) {
 
         if (streq(argv[1], "load")) {
 
+                entropy_fd = open(RANDOM_SEED_DIR "entropy_count", O_RDONLY|O_CLOEXEC|O_NOCTTY, 0600);
+                if (entropy_fd < 0) {
+                         entropy->entropy_count = 0;
+                         if (errno != ENOENT) {
+                                log_error("Failed to open " RANDOM_SEED "/entropy_count: %m");
+                                r = -errno;
+                                goto finish;
+                         }
+                } else {
+                        r = read(entropy_fd, &entropy->entropy_count, sizeof(entropy->entropy_count));
+                        if (r < 0) {
+                                log_error("Failed to read entropy count file: %m");
+                                r = -errno;
+                                goto finish;
+                        }
+                }
+
                 seed_fd = open(RANDOM_SEED, O_RDWR|O_CLOEXEC|O_NOCTTY|O_CREAT, 0600);
                 if (seed_fd < 0) {
                         seed_fd = open(RANDOM_SEED, O_RDONLY|O_CLOEXEC|O_NOCTTY);
@@ -103,7 +123,7 @@ int main(int argc, char *argv[]) {
                         }
                 }
 
-                k = loop_read(seed_fd, buf, buf_size, false);
+                k = loop_read(seed_fd, entropy->buf, entropy->buf_size, false);
                 if (k < 0)
                         r = log_error_errno(k, "Failed to read seed from " RANDOM_SEED ": %m");
                 else if (k == 0)
@@ -111,13 +131,29 @@ int main(int argc, char *argv[]) {
                 else {
                         (void) lseek(seed_fd, 0, SEEK_SET);
 
-                        r = loop_write(random_fd, buf, (size_t) k, false);
-                        if (r < 0)
-                                log_error_errno(r, "Failed to write seed to /dev/urandom: %m");
+                        if (entropy->entropy_count && ((size_t)k) == entropy->buf_size) {
+                                r = ioctl(random_fd, RNDADDENTROPY, entropy);
+                                if (r < 0) {
+                                        log_error_errno(errno, "Failed to write seed to /dev/urandom: %m");
+                                        r = -errno;
+                                }
+                        } else {
+                                r = loop_write(random_fd, entropy->buf, (size_t) k, false);
+                                if (r < 0)
+                                        log_error_errno(r, "Failed to write seed to /dev/urandom: %m");
+                        }
                 }
 
         } else if (streq(argv[1], "save")) {
 
+                /* Read available entropy count, if possible */
+                f = fopen("/proc/sys/kernel/random/entropy_avail", "re");
+                if (f) {
+                        if (fscanf(f, "%d", &entropy->entropy_count) < 0)
+                                entropy->entropy_count = 0;
+                        fclose(f);
+                }
+
                 seed_fd = open(RANDOM_SEED, O_WRONLY|O_CLOEXEC|O_NOCTTY|O_CREAT, 0600);
                 if (seed_fd < 0) {
                         r = log_error_errno(errno, "Failed to open " RANDOM_SEED ": %m");
@@ -130,6 +166,21 @@ int main(int argc, char *argv[]) {
                         goto finish;
                 }
 
+                if (entropy->entropy_count) {
+                        entropy_fd = open(RANDOM_SEED_DIR "entropy_count", O_WRONLY|O_CLOEXEC|O_NOCTTY|O_CREAT, 0600);
+                        if (seed_fd < 0) {
+                                log_error("Failed to open " RANDOM_SEED_DIR "entropy_count: %m");
+                                r = -errno;
+                                goto finish;
+                        }
+                        r = write(entropy_fd, &entropy->entropy_count, sizeof(entropy->entropy_count));
+                        if (r < 0) {
+                                log_error("Failed to write entropy count file: %m");
+                                r = -errno;
+                                goto finish;
+                        }
+                }
+
         } else {
                 log_error("Unknown verb '%s'.", argv[1]);
                 r = -EINVAL;
@@ -144,7 +195,7 @@ int main(int argc, char *argv[]) {
                 (void) fchmod(seed_fd, 0600);
                 (void) fchown(seed_fd, 0, 0);
 
-                k = loop_read(random_fd, buf, buf_size, false);
+                k = loop_read(random_fd, entropy->buf, entropy->buf_size, false);
                 if (k < 0) {
                         r = log_error_errno(k, "Failed to read new seed from /dev/urandom: %m");
                         goto finish;
@@ -155,7 +206,7 @@ int main(int argc, char *argv[]) {
                         goto finish;
                 }
 
-                r = loop_write(seed_fd, buf, (size_t) k, false);
+                r = loop_write(seed_fd, entropy->buf, (size_t) k, false);
                 if (r < 0)
                         log_error_errno(r, "Failed to write new random seed file: %m");
         }