diff options
| author | Leo Famulari <leo@famulari.name> | 2017-12-13 18:49:28 -0500 |
|---|---|---|
| committer | Leo Famulari <leo@famulari.name> | 2017-12-19 11:31:24 -0500 |
| commit | 9a56cf2b5b4970843c215091ea9823a67e077310 (patch) | |
| tree | d08753865b0d1c77bcc845a38f675996f0ebc20d | |
| parent | a8db968fa48ecb3dd219833a9e393a383d842215 (diff) | |
| download | guix-9a56cf2b5b4970843c215091ea9823a67e077310.tar.gz guix-9a56cf2b5b4970843c215091ea9823a67e077310.zip | |
services: urandom-seed: Try using a HWRNG to seed the Linux CRNG at boot.
* gnu/services/base.scm (urandom-seed-shepherd-service): Try to read from
'/dev/hwrng' at boot, as a supplement to any saved random seed.
* doc/guix.texi (Base Services): Document the new feature.
| -rw-r--r-- | doc/guix.texi | 4 | ||||
| -rw-r--r-- | gnu/services/base.scm | 18 |
2 files changed, 21 insertions, 1 deletions
diff --git a/doc/guix.texi b/doc/guix.texi index 3bb29db960..6b6f8dedae 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -10025,7 +10025,9 @@ well as in the @var{groups} field of the @var{operating-system} record. @deffn {Scheme Procedure} urandom-seed-service Save some entropy in @var{%random-seed-file} to seed @file{/dev/urandom} -when rebooting. +when rebooting. It also tries to seed @file{/dev/urandom} from +@file{/dev/hwrng} while booting, if @file{/dev/hwrng} exists and is +readable. @end deffn @defvr {Scheme Variable} %random-seed-file diff --git a/gnu/services/base.scm b/gnu/services/base.scm index 5e08927af3..a3654fd4d3 100644 --- a/gnu/services/base.scm +++ b/gnu/services/base.scm @@ -516,6 +516,24 @@ stopped before 'kill' is called." (call-with-output-file "/dev/urandom" (lambda (urandom) (dump-port seed urandom)))))) + + ;; Try writing from /dev/hwrng into /dev/urandom. + ;; It seems that the file /dev/hwrng always exists, even + ;; when there is no hardware random number generator + ;; available. So, we handle a failed read or any other error + ;; reported by the operating system. + (let ((buf (catch 'system-error + (lambda () + (call-with-input-file "/dev/hwrng" + (lambda (hwrng) + (get-bytevector-n hwrng 512)))) + ;; Silence is golden... + (const #f)))) + (when buf + (call-with-output-file "/dev/urandom" + (lambda (urandom) + (put-bytevector urandom buf))))) + ;; Immediately refresh the seed in case the system doesn't ;; shut down cleanly. (call-with-input-file "/dev/urandom" |