Changes in random_seed

0a9098d00fea89c48d26e8ec45087bd0ec34e0c8 - Rename MOUNTCRITLOCAL to CRITLOCALMOUNTED to avoid a name collision

Tue, 08 Sep 2020 12:52:18 +0000

Rename MOUNTCRITLOCAL to CRITLOCALMOUNTED to avoid a name collisionon case insensitive file systems List of files: /netbsd-src/etc/rc.d/random_seed

31fc9817bb38d52b2f936d8325529dda147b6ef7 - Split the local disk availability step into two phases to allow scripts

Wed, 22 Jul 2020 16:50:41 +0000

Split the local disk availability step into two phases to allow scriptsthat pre-populate parts of the system (e.g. a tmpfs based /var) aneasy place to plug in like:# REQUIRE: mountcritlocal# BEFORE: MOUNTCRITLOCALThis also cleans up the existing special handling a bit by separating itinto new scripts. All later scripts now depend on MOUNTCRITLOCAL.Discussed on tech-userlevel some time ago. List of files: /netbsd-src/etc/rc.d/random_seed

c4e3864f6796a2cb25fb3c1ddad052237f5bc77e - If no random seed file exists on boot, create one.

Thu, 07 May 2020 20:01:04 +0000

If no random seed file exists on boot, create one.rndctl -S triggers entropy consolidation, so whatever we gatheredduring kernel startup -- interrupt timings, autoconf timings, &c. --will be incorporated into the seed and into subsequent data read from/dev/urandom, just like if rndctl -L had run at this boot, and theseed will carry them into the next boot too.But it still avoids frequently consolidating entropy on any regularschedule, in order to continue to mitigate iterative-guessingattacks. List of files: /netbsd-src/etc/rc.d/random_seed

417c0880bdf11ddd95dc450e49a072c31a81b62d - Omit needless verbiage in error message.

Thu, 07 May 2020 20:00:38 +0000

Omit needless verbiage in error message. List of files: /netbsd-src/etc/rc.d/random_seed

2569c9df6354c524896a25e33c73d88f71c1e384 - Pass full pathname to df, and print warning message on failure.

Thu, 07 May 2020 18:15:29 +0000

Pass full pathname to df, and print warning message on failure.No need to extract dirname; `df -P /var/db/entropy-file' and `df -l/var/db/entropy-file' work just fine. List of files: /netbsd-src/etc/rc.d/random_seed

1e65f60a58a5db689229cc2d4b183e6357066b9e - Tweak logic to decide whether a medium is safe for an rndseed.

Wed, 06 May 2020 18:49:26 +0000

Tweak logic to decide whether a medium is safe for an rndseed.- Teach rndctl to load the seed, but treat it as zero entropy, if the medium is read-only or if the update fails.- Teach rndctl to accept `-i' flag instructing it to ignore the entropy estimate in the seed.- Teach /etc/rc.d/random_seed to: (a) assume nonlocal file systems are unsafe, and use -i, but (b) assume / is safe, even if it is nonlocal. If the medium is nonwritable, leave it to rndctl to detect that. (Could use statvfs and check for ST_LOCAL in rndctl, I guess, but I already implemented it this way.)Treating nonlocal / as safe is a compromise: it's up to the operatorto secure the network for (e.g.) nfs mounts, but that's true whetherwe're talking entropy or not -- if the adversary has access to thenetwork that you've mounted / from, they can do a lot more damageanyway; this reduces warning fatigue for diskless systems, e.g. testracks. List of files: /netbsd-src/etc/rc.d/random_seed

9062e0fce18b1b6019e4fd396469c8d83207f4ce - Don't delete the random seed before issuing `rndctl -S'.

Fri, 01 May 2020 15:52:38 +0000

Don't delete the random seed before issuing `rndctl -S'.`rndctl -S' can replace the file just fine, and deleting it ahead oftime adds a window during which we can lose the seed altogether ifthe system is interrupted by a crash or power outage.XXX pullup List of files: /netbsd-src/etc/rc.d/random_seed

d3b9fe60e328613bb5b2dcf8502df0bae1934d5d - Allow random seed on zfs.

Sun, 23 Feb 2020 08:53:14 +0000

Allow random seed on zfs. List of files: /netbsd-src/etc/rc.d/random_seed

7f6fa646671e420f5e45b7c096b4b9b4202ab020 - 'file system' for consistency with documentation (instead of 'filesystem').

Tue, 22 Jul 2014 17:11:09 +0000

'file system' for consistency with documentation (instead of 'filesystem'). List of files: /netbsd-src/etc/rc.d/random_seed

7c8b13934dc040b6e4a32416bb979e5ab4e767a9 - better messages, more quoting.

Sat, 29 Dec 2012 22:15:07 +0000

better messages, more quoting. List of files: /netbsd-src/etc/rc.d/random_seed

448aa50d4c550ee4c69d29de89206a5e8416495f - Reinstate the dirname invocations that were recently removed from

Mon, 17 Dec 2012 18:20:50 +0000

Reinstate the dirname invocations that were recently removed fromrc.d/random_seed. The new dirname shell function provided by rc.subrwill be used, so it should work before the /usr file system is mounted.This should fix a problem in which the fs_safe shell function failed whenpassed the name of a file that did not exist. List of files: /netbsd-src/etc/rc.d/random_seed

c755e023f241af553ce8b21357fc6264862e6702 - Avoid using programs from /usr/bin. This should fix PR 47326.

Fri, 14 Dec 2012 18:42:25 +0000

Avoid using programs from /usr/bin. This should fix PR 47326.- no need for "dirname", because "df -G" can take a file name directly.- replace use of "awk" with a shell while read loop.- replace use of "stat -s" with "ls -ldn".- no need for "tail" now that the use of "stat" has changed.While here, also add some shell quotes and improve the grammar in a comment. List of files: /netbsd-src/etc/rc.d/random_seed

5f5f1a05ccda844f34496f177313ce6f01c6c1b1 - Cause /etc/rc.d/random_seed to be the first script to run

Sat, 10 Nov 2012 15:10:22 +0000

Cause /etc/rc.d/random_seed to be the first script to runafter mountcritlocal. Everything else that runs aftermountcritlocal depends directly or indirectly on bootconf, somaking random_seed run before bootconf has the desired result. List of files: /netbsd-src/etc/rc.d/random_seed

f9669c1ea46f688590cf670be9c8345032f68e5c - It's msdos, not msdosfs.

Sun, 08 Jul 2012 14:25:49 +0000

It's msdos, not msdosfs. List of files: /netbsd-src/etc/rc.d/random_seed

4924aa205a64e505387dca5e5c074833607de7eb - Load entropy at system boot (only works at securelevel < 1); save

Wed, 23 Nov 2011 10:47:48 +0000

Load entropy at system boot (only works at securelevel < 1); saveat system shutdown. Disable with random_seed=NO in rc.conf if desired.Goes to some trouble to never load or save to network filesystems.Entropy should really be loaded by the boot loader but I am stillsorting out how to pass it to the kernel. List of files: /netbsd-src/etc/rc.d/random_seed