all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: Leo Famulari <leo@famulari.name>
To: "Ludovic Courtès" <ludo@gnu.org>
Cc: 23605@debbugs.gnu.org
Subject: bug#23605: /dev/urandom not seeded across reboots
Date: Thu, 26 May 2016 12:47:07 -0400	[thread overview]
Message-ID: <20160526164707.GA11671@jasmine> (raw)
In-Reply-To: <87vb229ixp.fsf@gnu.org>

[-- Attachment #1: Type: text/plain, Size: 950 bytes --]

On Wed, May 25, 2016 at 06:54:58PM +0200, Ludovic Courtès wrote:
> 
> Yes, it’s:
> 
>   (service TYPE VALUE)
> 
> but I think there’s no meaningful value for this service, so you could
> do:
> 
>   (service urandom-seed-service-type #f)

I'm struggling to make this work. Do I need to alter the definition of
urandom-seed-shepherd-service to accept the boolean?

With the attached diff, building a VM fails like this (full backtrace
attached):

[...]
 573: 2 [loop #<<service> type: # parameters: ()>]
In srfi/srfi-1.scm:
 578: 1 [map #<procedure 519cc20 at gnu/services.scm:562:4 (service)> (# # # # ...)]
In gnu/services/base.scm:
1217: 0 [urandom-seed-shepherd-service #f]

gnu/services/base.scm:1217:0: In procedure urandom-seed-shepherd-service:
gnu/services/base.scm:1217:0: Wrong number of arguments to #<procedure urandom-seed-shepherd-service ()>

> Sounds like you’re pretty much there!  :-)

Almost, I hope! Thanks for your help :)

[-- Attachment #2: backtrace --]
[-- Type: text/plain, Size: 1565 bytes --]

Backtrace:
In ice-9/boot-9.scm:
1724: 19 [%start-stack load-stack ...]
1729: 18 [#<procedure 151cea0 ()>]
In unknown file:
   ?: 17 [primitive-load "/home/leo/work/guix/scripts/guix"]
In guix/ui.scm:
1201: 16 [run-guix-command system "vm" "/home/leo/tmp/bare-bones.scm"]
In ice-9/boot-9.scm:
 157: 15 [catch srfi-34 #<procedure 31d2e20 at guix/ui.scm:425:2 ()> ...]
 157: 14 [catch system-error ...]
In guix/scripts/system.scm:
 882: 13 [#<procedure 3f1f7b0 at guix/scripts/system.scm:874:2 ()>]
 788: 12 [process-action vm ("/home/leo/tmp/bare-bones.scm") ...]
In guix/store.scm:
1163: 11 [run-with-store # ...]
In guix/scripts/system.scm:
 800: 10 [#<procedure 3f72660 at guix/scripts/system.scm:792:8 (state)> #]
 564: 9 [perform-action vm # # ...]
In gnu/system/vm.scm:
 496: 8 [system-qemu-image/shared-store-script # # # ...]
In gnu/system.scm:
 601: 7 [operating-system-derivation # # #f]
In gnu/services.scm:
 573: 6 [loop #]
In srfi/srfi-1.scm:
 578: 5 [map #<procedure loop (sink)> (# # #)]
In gnu/services.scm:
 573: 4 [loop #<<service> type: # parameters: #>]
In srfi/srfi-1.scm:
 578: 3 [map #<procedure loop (sink)> (# # #)]
In gnu/services.scm:
 573: 2 [loop #<<service> type: # parameters: ()>]
In srfi/srfi-1.scm:
 578: 1 [map #<procedure 2dbfcc0 at gnu/services.scm:562:4 (service)> (# # # # ...)]
In gnu/services/base.scm:
1217: 0 [urandom-seed-shepherd-service #f]

gnu/services/base.scm:1217:0: In procedure urandom-seed-shepherd-service:
gnu/services/base.scm:1217:0: Wrong number of arguments to #<procedure urandom-seed-shepherd-service ()>

[-- Attachment #3: urandom-seed-service.patch --]
[-- Type: text/x-diff, Size: 3019 bytes --]

diff --git a/gnu/services/base.scm b/gnu/services/base.scm
index 96bf8da..041768f 100644
--- a/gnu/services/base.scm
+++ b/gnu/services/base.scm
@@ -93,6 +93,8 @@
             gpm-service-type
             gpm-service
 
+            urandom-seed-service
+
             %base-services))
 
 ;;; Commentary:
@@ -1200,6 +1202,57 @@ extra rules from the packages listed in @var{rules}."
   "Return a service that uses @var{device} as a swap device."
   (service swap-service-type device))
 
+(define %random-seed-file
+  "/var/run/random-seed")
+
+(define %urandom-seed-activation
+  ;; Activation gexp for the urandom seed
+  #~(begin
+      (use-modules (guix build utils))
+
+      (mkdir-p (dirname %random-seed-file))
+      (close-port (open-output-file %random-seed-file))
+      (chmod %random-seed-file #o600)))
+
+(define (urandom-seed-shepherd-service)
+  "Return a shepherd service for the /dev/urandom seed."
+  (shepherd-service
+    (documentation "Preserve entropy across reboots for /dev/urandom.")
+    (provision '(urandom-seed))
+    (requirement '(user-processes)) ; whatever provides file-systems /var and /dev
+    (start #~(lambda _
+               (when (file-exists? #$%random-seed-file)
+                 (call-with-input-file #$%random-seed-file
+                   (lambda (seed)
+                     (call-with-output-file "/dev/urandom"
+                       (lambda (urandom)
+                         (dump-port seed urandom))))))
+               #t))
+    (stop #~(lambda _
+              (let ((buf (make-bytevector 512)))
+                (call-with-input-file "/dev/urandom"
+                  (lambda (urandom)
+                    (get-bytevector-n! urandom buf 0 512)
+                    (call-with-output-file #$%random-seed-file
+                      (lambda (seed)
+                        (put-bytevector seed buf)))
+                    #t)))))
+    (modules `((rnrs bytevectors)
+               (rnrs io ports)
+               ,@%default-modules))))
+
+(define urandom-seed-service-type
+  (service-type (name 'urandom-seed)
+                (extensions
+                 (list (service-extension shepherd-root-service-type
+                                          urandom-seed-shepherd-service)
+                       (service-extension activation-service-type
+                                          (const %urandom-seed-activation))
+                       ;; Add urandom-seed to the system profile
+                       (service-extension profile-service-type list)))))
+
+(define (urandom-seed-service)
+  (service urandom-seed-service-type #f))
 
 (define-record-type* <gpm-configuration>
   gpm-configuration make-gpm-configuration gpm-configuration?
@@ -1281,6 +1334,7 @@ This is the GNU operating system, welcome!\n\n")))
           (static-networking-service "lo" "127.0.0.1"
                                      #:provision '(loopback))
           (syslog-service)
+          (urandom-seed-service)
           (guix-service)
           (nscd-service)
 

  reply	other threads:[~2016-05-26 16:48 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-05-23 17:58 bug#23605: /dev/urandom not seeded across reboots Leo Famulari
2016-05-24  7:05 ` Taylan Ulrich Bayırlı/Kammer
2016-05-24 16:16   ` Leo Famulari
2016-05-24 16:26     ` Thompson, David
2016-05-24 17:23       ` Leo Famulari
2016-05-24 17:29         ` Thompson, David
2016-05-25 21:53       ` Ludovic Courtès
2016-05-24 12:24 ` Ludovic Courtès
2016-05-25 16:38   ` Leo Famulari
2016-05-25 16:54     ` Ludovic Courtès
2016-05-26 16:47       ` Leo Famulari [this message]
2016-05-28 13:57         ` Ludovic Courtès
2016-05-28 18:05           ` Leo Famulari
2016-05-28 18:10             ` Leo Famulari
2016-05-28 18:26             ` Leo Famulari
2016-05-28 20:41               ` Leo Famulari
2016-05-28 20:53             ` Ludovic Courtès
2016-05-29  0:00               ` Leo Famulari
2016-05-29  0:04                 ` Leo Famulari
2016-05-29 20:23                 ` Ludovic Courtès
2016-05-28  1:12   ` Leo Famulari
2016-05-28 13:51     ` Ludovic Courtès
2016-05-28  1:05 ` Leo Famulari
2016-05-28  1:11   ` Ben Woodcroft
2016-05-28  1:45     ` Leo Famulari
2016-05-28  9:40       ` Ben Woodcroft

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160526164707.GA11671@jasmine \
    --to=leo@famulari.name \
    --cc=23605@debbugs.gnu.org \
    --cc=ludo@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.