From patchwork Fri May 29 11:19:05 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Jackson X-Patchwork-Id: 11578337 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 39A6E1391 for ; Fri, 29 May 2020 11:21:05 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 1C95D20721 for ; Fri, 29 May 2020 11:21:05 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1C95D20721 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=eu.citrix.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1jed49-0006od-BY; Fri, 29 May 2020 11:20:45 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1jed48-0006nv-DN for xen-devel@lists.xenproject.org; Fri, 29 May 2020 11:20:44 +0000 X-Inumbo-ID: 559fe83c-a19e-11ea-9dbe-bc764e2007e4 Received: from chiark.greenend.org.uk (unknown [2001:ba8:1e3::]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id 559fe83c-a19e-11ea-9dbe-bc764e2007e4; Fri, 29 May 2020 11:20:00 +0000 (UTC) Received: from [172.18.45.5] (helo=zealot.relativity.greenend.org.uk) by chiark.greenend.org.uk (Debian Exim 4.84_2 #1) with esmtp (return-path ijackson@chiark.greenend.org.uk) id 1jed3P-0003xZ-Lq; Fri, 29 May 2020 12:19:59 +0100 From: Ian Jackson To: xen-devel@lists.xenproject.org Subject: [OSSTEST PATCH 09/49] Bodge systemd random seed arrangements Date: Fri, 29 May 2020 12:19:05 +0100 Message-Id: <20200529111945.21394-10-ian.jackson@eu.citrix.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200529111945.21394-1-ian.jackson@eu.citrix.com> References: <20200529111945.21394-1-ian.jackson@eu.citrix.com> MIME-Version: 1.0 X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Ian Jackson Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" systemd does not regard the contents of the random seed file as useful for the purposes of placating the kernel's entropy tracker. As a result, the system hangs at boot waiting for entropy. Fix this by providing a small program which can be used to load a seed file into /dev/random and also call RNDADDTOENTCNT to add the appropriate amount to the kernel's counter. Arrange to run this program instead of /lib/systemd/systemd-random-seed load With systemd the random seed file is in /var/lib/systemd/random-seed rather than /var/lib/urandom/random-seed. And, provide an initial contents of this file, via a d-i late_command. Unfortunately we must hardcode the actual numerical value of RNDADDTOENTCNT because we don't have a suitable compiler anywhere nearby. It seems to have the same value on i386, amd64, armhf and arm64, our currently supported architectures. Thanks to Colin Watson for pointers to the systemd random unit and Matthew Vernon for instructions on overriding just ExecStart. I think this change should be a no-op on non-systemd systems. In principle this is a bug in Debian or in systemd, that ought to be reported upstream. However, it has been extensively discussed on debian-devel and it does not seem that any improvement is likely. Signed-off-by: Ian Jackson --- Osstest/Debian.pm | 18 ++++++++++ .../override.conf | 3 ++ overlay/usr/local/bin/random-seed-add | 33 +++++++++++++++++++ 3 files changed, 54 insertions(+) create mode 100644 overlay/etc/systemd/system/systemd-random-seed.service.d/override.conf create mode 100755 overlay/usr/local/bin/random-seed-add diff --git a/Osstest/Debian.pm b/Osstest/Debian.pm index b8bf67dc..8ccacc79 100644 --- a/Osstest/Debian.pm +++ b/Osstest/Debian.pm @@ -49,6 +49,7 @@ BEGIN { di_installcmdline_core di_vg_name debian_dhcp_rofs_fix + debian_write_random_seed_command ); %EXPORT_TAGS = ( ); @@ -1087,6 +1088,13 @@ ln -s . /target/boot/boot END } + my $cmd = debian_write_random_seed_command('/target'); + preseed_hook_command($ho, 'late_command', $sfx, <', '/dev/random' or die "open /dev/random: $!\n"; +R->autoflush(1); + +sub rndaddtoentcnt ($) { + my ($bits) = @_; + my $x = pack 'L', $bits; + my $r = ioctl R, 0x40045201, $x; + defined $r or die "RNDADDTOENTCNT: $!\n"; +} + +sub process_stdin ($) { + my ($f) = @_; + my $got = read STDIN, $_, 512; + defined $got or die "read $f: $!\n"; + last if !$got; + print R $_ or die "write /dev/random: $!\n"; + my $bits = length($_) * 8; + rndaddtoentcnt($bits); +} + +if (!@ARGV) { + process_stdin('stdin'); +} else { + die "no options supported\n" if $ARGV[0] =~ m/^\-/; + foreach my $f (@ARGV) { + open STDIN, '<', $f or die "open for reading $f: $!\n"; + process_stdin($f); + } +} +