From mboxrd@z Thu Jan 1 00:00:00 1970 From: Leo Famulari Subject: bug#29773: urandom-seed-service should run earlier in the boot process Date: Tue, 19 Dec 2017 14:13:48 -0500 Message-ID: <20171219191348.GA19177@jasmine.lan> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="tThc/1wpZn/ma/RB" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:43121) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eRNM1-0005x4-95 for bug-guix@gnu.org; Tue, 19 Dec 2017 14:15:09 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eRNLy-0000Zq-3G for bug-guix@gnu.org; Tue, 19 Dec 2017 14:15:05 -0500 Received: from debbugs.gnu.org ([208.118.235.43]:33974) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1eRNLx-0000Zd-V4 for bug-guix@gnu.org; Tue, 19 Dec 2017 14:15:02 -0500 Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1eRNLx-0004Y9-Mg for bug-guix@gnu.org; Tue, 19 Dec 2017 14:15:01 -0500 Sender: "Debbugs-submit" Resent-Message-ID: Received: from eggs.gnu.org ([2001:4830:134:3::10]:41798) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1eRNKw-0005OT-8e for bug-guix@gnu.org; Tue, 19 Dec 2017 14:13:59 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1eRNKt-0008GR-1g for bug-guix@gnu.org; Tue, 19 Dec 2017 14:13:58 -0500 Received: from out3-smtp.messagingengine.com ([66.111.4.27]:59759) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1eRNKs-0008DS-Ps for bug-guix@gnu.org; Tue, 19 Dec 2017 14:13:54 -0500 Received: from localhost (unknown [172.58.201.122]) by mail.messagingengine.com (Postfix) with ESMTPA id 93E9F24009 for ; Tue, 19 Dec 2017 14:13:50 -0500 (EST) Content-Disposition: inline List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: 29773@debbugs.gnu.org --tThc/1wpZn/ma/RB Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable The urandom-seed-service preserves some of the Linux cryptographic random number generator's (CRNG) pool across reboots so that freshly booted systems have access to unpredictable psuedorandom numbers. It also tries to take advantage of whatever is backing /dev/hwrng. However, the urandom-seed-service may not be started before certain applications that assume a good source of randomness. In some cases, the applications require some random data before any services are started, during activation. For example, our OpenSSH service generates its host keys during activation. And even if it generated host keys during the start of the OpenSSH service, that service does not depend on urandom-seed-service. [0] In systemd, there is an abstract sysinit "target" that basically serves as a checkpoint. All the lower-level system initialization is required before the sysinit.target is met, and the rest of the services depend on sysinit. The random seeding is part of sysinit. I've reproduced a graph of this in [1]. In practice, I'm not sure if it matters. I'd appreciate if GuixSD users could check /var/log/messages for warnings like this one and report them: random: application: uninitialized urandom read (16 bytes read)=20 And I'd also appreciate any feedback or ideas for improvement in this area. [0] See the attached service graph of a bare-bones system with OpenSSH. [1] from: local-fs-pre.target | v (various mounts and (various swap (various cryptsetup fsck services...) devices...) devices...) (various low-le= vel (various low-level | | | services: udev= d, API VFS mounts: v v v tmpfiles, rand= om mqueue, configfs, local-fs.target swap.target cryptsetup.target seed, sysctl, .= =2E.) debugfs, ...) | | | | = | \__________________|_________________ | ___________________|______= ______________/ \|/ v sysinit.target | ____________________________________/|\__________________________= ______________ / | | | = \ | | | | = | v v | v = v (various (various | (various = rescue.service timers...) paths...) | sockets...) = | | | | | = v v v | v = rescue.target timers.target paths.target | sockets.target | | | | v \_________________ | ___________________/ \|/ v basic.target | ____________________________________/| = emergency.service / | | = | | | | = v v v v = emergency.target display- (various system (various system manager.service services services) | required for | | graphical UIs) v | | multi-user.target | | | \_________________ | _________________/ \|/ v graphical.target --tThc/1wpZn/ma/RB Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEsFFZSPHn08G5gDigJkb6MLrKfwgFAlo5ZOkACgkQJkb6MLrK fwj1ZxAAspjMPR2YabJVapuCz5rPmsSFHzXA9S4QlveffqRtSlHJwfrFxrZfezLY wtbbB640BCEP3UWpHx3pi8F8Kjzv7k1Q/cf5M5nZLevj2ZQRwcI0M7eIVZddUCZm wqZGssC0CIDHYcZv1iC8FE3nW1txsuqpYfUPkdYbcvfOqHywdMpBuMahzX412rG6 B7V44/athWu1werWqgETADb+zCPxggb7OyZBbaBpc6NbOO4I19HvSFAK0Hzp/vV8 PcnnKeOtUqAWf8+uvfkOXiK22Z1d7ZCDGsrVhEx/93Z/Z/RM/LpI360Vis/WpU+0 U7hyvXcpHhcB3+OinOxHDaxwd/fwoWwgQ1rwbb4YfR2lzv10mLWo4/3uq6eH0jmU 7ZQ3c1PygZ/QuJ574lgVnstD787uSvl/kOeununqOJWHRNDpF7H68SGqio3VIbJw ipLvPb/VHfC9gHEqBUOmSi4xJC919uo65pbG+b8wMA9Jwc8WvIdav03Yc/zdV5xJ EVf/42eOYUQuXUesri4McPRyiCx3vbrq5bgcdi0R3J3GQw/h9zh/Z1RDHYYfjtpy C86zXZvBQimSBEGJLDO7C5SEuhXcpEDM5Uo0uh+sucRy7NBiy7jmf5O0b2qO/ATj zlSg1HDg8/JprcIeRlcV1Ah9umCP1umAFzhVqb/jcRprLXKscEg= =ZgHn -----END PGP SIGNATURE----- --tThc/1wpZn/ma/RB--