diff --git a/systemd-mini.changes b/systemd-mini.changes index 6a8f2c70..a3cbb03a 100644 --- a/systemd-mini.changes +++ b/systemd-mini.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Wed Aug 27 12:52:09 UTC 2014 - werner@suse.de + +- Add patch use-rndaddentropy-ioctl-to-load-random-seed.patch to + use RNDADDENTROPY ioctl to load random-seed and to increase + entropy count as well (bnc#892096) + ------------------------------------------------------------------- Tue Aug 26 12:13:42 UTC 2014 - werner@suse.de diff --git a/systemd-mini.spec b/systemd-mini.spec index 887777cd..6fc89cf0 100644 --- a/systemd-mini.spec +++ b/systemd-mini.spec @@ -798,6 +798,8 @@ Patch383: 0003-keymap-Fix-HP-Pavillon-DV7.patch Patch384: 0004-hwdb-update-format-description-and-document-reloadin.patch # PATCH-FIX-UPSTREAM added at 2014/08/25 Patch385: 0008-hwdb-update.patch +# PATCH-FIX-SUSE Use RNDADDENTROPY ioctl to load random-seed and to increase entropy count as well (bnc#892096) +Patch386: use-rndaddentropy-ioctl-to-load-random-seed.patch # UDEV PATCHES # ============ @@ -1475,6 +1477,7 @@ cp %{SOURCE7} m4/ %patch383 -p0 %patch384 -p0 %patch385 -p0 +%patch386 -p1 # udev patches %patch1001 -p1 diff --git a/systemd.changes b/systemd.changes index 6a8f2c70..a3cbb03a 100644 --- a/systemd.changes +++ b/systemd.changes @@ -1,3 +1,10 @@ +------------------------------------------------------------------- +Wed Aug 27 12:52:09 UTC 2014 - werner@suse.de + +- Add patch use-rndaddentropy-ioctl-to-load-random-seed.patch to + use RNDADDENTROPY ioctl to load random-seed and to increase + entropy count as well (bnc#892096) + ------------------------------------------------------------------- Tue Aug 26 12:13:42 UTC 2014 - werner@suse.de diff --git a/systemd.spec b/systemd.spec index cfdfe49d..33b8dbe9 100644 --- a/systemd.spec +++ b/systemd.spec @@ -793,6 +793,8 @@ Patch383: 0003-keymap-Fix-HP-Pavillon-DV7.patch Patch384: 0004-hwdb-update-format-description-and-document-reloadin.patch # PATCH-FIX-UPSTREAM added at 2014/08/25 Patch385: 0008-hwdb-update.patch +# PATCH-FIX-SUSE Use RNDADDENTROPY ioctl to load random-seed and to increase entropy count as well (bnc#892096) +Patch386: use-rndaddentropy-ioctl-to-load-random-seed.patch # UDEV PATCHES # ============ @@ -1470,6 +1472,7 @@ cp %{SOURCE7} m4/ %patch383 -p0 %patch384 -p0 %patch385 -p0 +%patch386 -p1 # udev patches %patch1001 -p1 diff --git a/use-rndaddentropy-ioctl-to-load-random-seed.patch b/use-rndaddentropy-ioctl-to-load-random-seed.patch new file mode 100644 index 00000000..3cbe548a --- /dev/null +++ b/use-rndaddentropy-ioctl-to-load-random-seed.patch @@ -0,0 +1,121 @@ +Simply writing /var/lib/systemd/random-seed back to /dev/(u)random does not +increase the entropy bit count. Therefore use the RNDADDENTROPY ioctl to +write back the bytes and increase the entropy bit counter. + +Related to bnc#892096 + +--- + systemd-210/src/random-seed/random-seed.c | 66 +++++++++++++++++++++++++++--- + 1 file changed, 61 insertions(+), 5 deletions(-) + +--- systemd-210/src/random-seed/random-seed.c ++++ systemd-210/src/random-seed/random-seed.c 2014-08-27 11:58:59.022526580 +0000 +@@ -22,7 +22,9 @@ + #include + #include + #include ++#include + #include ++#include + #include + + #include "log.h" +@@ -32,8 +34,9 @@ + #define POOL_SIZE_MIN 512 + + int main(int argc, char *argv[]) { +- _cleanup_close_ int seed_fd = -1, random_fd = -1; ++ _cleanup_close_ int seed_fd = -1, random_fd = -1, entropy_fd = -1; + _cleanup_free_ void* buf = NULL; ++ size_t entropy_count = 0; + size_t buf_size = 0; + ssize_t k; + int r; +@@ -82,6 +85,23 @@ int main(int argc, char *argv[]) { + + if (streq(argv[1], "load")) { + ++ entropy_fd = open(RANDOM_SEED_DIR "entropy_count", O_RDONLY|O_CLOEXEC|O_NOCTTY, 0600); ++ if (entropy_fd < 0) { ++ entropy_count = 0; ++ if (errno != ENOENT) { ++ log_error("Failed to open " RANDOM_SEED "/entropy_count: %m"); ++ r = -errno; ++ goto finish; ++ } ++ } else { ++ r = read(entropy_fd, &entropy_count, sizeof(entropy_count)); ++ if (r < 0) { ++ log_error("Failed to read entropy count file: %m"); ++ r = -errno; ++ goto finish; ++ } ++ } ++ + seed_fd = open(RANDOM_SEED, O_RDWR|O_CLOEXEC|O_NOCTTY|O_CREAT, 0600); + if (seed_fd < 0) { + seed_fd = open(RANDOM_SEED, O_RDONLY|O_CLOEXEC|O_NOCTTY); +@@ -113,16 +133,37 @@ int main(int argc, char *argv[]) { + } else { + lseek(seed_fd, 0, SEEK_SET); + +- k = loop_write(random_fd, buf, (size_t) k, false); +- if (k <= 0) { +- log_error("Failed to write seed to /dev/urandom: %s", r < 0 ? strerror(-r) : "short write"); ++ if (entropy_count && (size_t) k == buf_size) { ++ struct rand_pool_info entropy = { ++ .entropy_count = entropy_count, ++ .buf_size = buf_size, ++ }; ++ entropy.buf[0] = ((__u32*)buf)[0]; ++ r = ioctl(random_fd, RNDADDENTROPY, &entropy); ++ if (r < 0) { ++ log_error("Failed to write seed to /dev/urandom: %m"); ++ r = -errno; ++ } ++ } else { ++ k = loop_write(random_fd, buf, (size_t) k, false); ++ if (k <= 0) { ++ log_error("Failed to write seed to /dev/urandom: %s", r < 0 ? strerror(-r) : "short write"); + +- r = k == 0 ? -EIO : (int) k; ++ r = k == 0 ? -EIO : (int) k; ++ } + } + } + + } else if (streq(argv[1], "save")) { + ++ /* Read available entropy count, if possible */ ++ f = fopen("/proc/sys/kernel/random/entropy_avail", "re"); ++ if (f) { ++ if (fscanf(f, "%zu", &entropy_count) < 0) ++ entropy_count = 0; ++ fclose(f); ++ } ++ + seed_fd = open(RANDOM_SEED, O_WRONLY|O_CLOEXEC|O_NOCTTY|O_CREAT, 0600); + if (seed_fd < 0) { + log_error("Failed to open " RANDOM_SEED ": %m"); +@@ -137,6 +178,21 @@ int main(int argc, char *argv[]) { + goto finish; + } + ++ if (entropy_count) { ++ entropy_fd = open(RANDOM_SEED_DIR "entropy_count", O_WRONLY|O_CLOEXEC|O_NOCTTY|O_CREAT, 0600); ++ if (seed_fd < 0) { ++ log_error("Failed to open " RANDOM_SEED_DIR "entropy_count: %m"); ++ r = -errno; ++ goto finish; ++ } ++ r = write(entropy_fd, &entropy_count, sizeof(entropy_count)); ++ if (r < 0) { ++ log_error("Failed to write entropy count file: %m"); ++ r = -errno; ++ goto finish; ++ } ++ } ++ + } else { + log_error("Unknown verb %s.", argv[1]); + r = -EINVAL;