bug#23605: /dev/urandom not seeded across reboots

[ludo@gnu.org (Ludovic Courtès)]

Leo Famulari <leo@famulari.name> skribis:

> I realized that we don't seem to be saving any of the entropy in the
> kernel's random pool [0] across reboots.
>
> This means that for some period after boot, /dev/urandom may not be safe
> to use. From random(4):

Good catch!

Some comments:

> +(define %urandom-seed-activation
> +  ;; Activation gexp for the urandom seed
> +  #~(begin
> +      (use-modules (guix build utils))
> +
> +      (mkdir-p "/var/run")
> +      (close-port (open-file "/var/run/urandom-seed" "a0b"))

Or simply ‘open-output-file’.

Maybe do:

  (define %random-seed-file
    "/var/run/random-seed")

to avoid repeating the file name everywhere.

> +         (start #~(lambda _
> +                    (exec-command
> +                      (zero?
> +                        (system (string-append "cat "
> +                                               "/var/run/urandom-seed"
> +                                               " > /dev/urandom"))))))

Instead of spawning ‘cat’, we can do:

  (when (file-exists? #$%random-seed-file)
    (call-with-input-file #$%random-seed-file
      (lambda (seed)
        (call-with-output-file "/dev/urandom"
          (lambda (random)
            (dump-port seed random))))))
  #t   ;service successfully “started”

> +         (stop #~(lambda _
> +                   (exec-command
> +                     (zero?
> +                       (system* "dd" "if=/dev/urandom"
> +                                (string-append "of=" "/var/run/urandom-seed")
> +                                "count=1" "bs=512"))))))))

Likewise, I would suggest using:

  (let ((buf (make-bytevector 512)))
    (call-with-input-file "/dev/urandom"
      (lambda (random)
        (get-bytevector-n! random buf 512)))
    …)

Thanks for looking into it!

Ludo’.