diff options
Diffstat (limited to 'libexec/save-entropy')
| -rw-r--r-- | libexec/save-entropy/Makefile | 4 | ||||
| -rw-r--r-- | libexec/save-entropy/Makefile.depend | 10 | ||||
| -rw-r--r-- | libexec/save-entropy/save-entropy.8 | 97 | ||||
| -rwxr-xr-x | libexec/save-entropy/save-entropy.sh | 132 |
4 files changed, 243 insertions, 0 deletions
diff --git a/libexec/save-entropy/Makefile b/libexec/save-entropy/Makefile new file mode 100644 index 000000000000..5d7e9726b786 --- /dev/null +++ b/libexec/save-entropy/Makefile @@ -0,0 +1,4 @@ +SCRIPTS= save-entropy.sh +MAN= save-entropy.8 + +.include <bsd.prog.mk> diff --git a/libexec/save-entropy/Makefile.depend b/libexec/save-entropy/Makefile.depend new file mode 100644 index 000000000000..11aba52f82cf --- /dev/null +++ b/libexec/save-entropy/Makefile.depend @@ -0,0 +1,10 @@ +# Autogenerated - do NOT edit! + +DIRDEPS = \ + + +.include <dirdeps.mk> + +.if ${DEP_RELDIR} == ${_DEP_RELDIR} +# local dependencies - needed for -jN in clean tree +.endif diff --git a/libexec/save-entropy/save-entropy.8 b/libexec/save-entropy/save-entropy.8 new file mode 100644 index 000000000000..f7a93c8866fc --- /dev/null +++ b/libexec/save-entropy/save-entropy.8 @@ -0,0 +1,97 @@ +.\" +.\" SPDX-License-Identifier: BSD-2-Clause +.\" +.\" Copyright (c) 2023 Fernando Apesteguia <fernando.apesteguia@gmail.com> +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +.\" SUCH DAMAGE. +.\" +.Dd September 18, 2023 +.Dt SAVE-ENTROPY 8 +.Os +.Sh NAME +.Nm save-entropy +.Nd Save bits of entropy to feed /dev/random at startup +.Sh SYNOPSIS +.Nm save-entropy +.Sh DESCRIPTION +The +.Nm +command is used to save entropy data from +.Pa /dev/random +to files in a specified output location. +The files saved are used at startup to provide additional entropy for +.Pa /dev/random . +The output file will be different in every invocation until the maximum number +of different files is reached. +(See +.Em entropy_save_num +for details). +By default this script is invoked via +.Xr cron 8 +every eleven minutes approximately. +.Pp +This command does nothing if executed inside a +.Xr jail 8 . +.Pp +Three variables in +.Pa /etc/rc.conf +regulate the behavior of the script: +.Bl -tag -width Ds +.It Va entropy_dir +Specify the directory for saved entropy files. +Defaults to +.Pa /var/db/entropy . +If set to "NO" it disables caching entropy via +.Xr cron 8 . +This setting is shared with +.Pa /etc/rc.d/random . +.It Va entropy_save_sz +Size of the entropy cache files. +Defaults to 4096. +.It Va entropy_save_num +Number of entropy cache files to save. +Defaults to 8. +.El +.Sh FILES +.Bl -tag -width Ds +.It Pa /etc/rc.conf +.El +.Sh EXIT STATUS +.Ex -std +Errors will be recorded in the system log. +.Sh SEE ALSO +.Xr syslog 3 , +.Xr random 4 , +.Xr rc.conf 5 , +.Xr cron 8 +.Sh HISTORY +The +.Nm +command first appeared in +.Fx 5.0 . +.Sh AUTHORS +The +.Nm +command was originally written by +.An Doug Barton <dougb@FreeBSD.org> . +This manual page was written by +.An Fernando Apesteguia <fernape@FreeBSD.org> . diff --git a/libexec/save-entropy/save-entropy.sh b/libexec/save-entropy/save-entropy.sh new file mode 100755 index 000000000000..fc9dbd889f63 --- /dev/null +++ b/libexec/save-entropy/save-entropy.sh @@ -0,0 +1,132 @@ +#!/bin/sh +# +# SPDX-License-Identifier: BSD-2-Clause +# +# Copyright (c) 2001-2006,2012 Douglas Barton, dougb@FreeBSD.org +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. +# + +# This script is called by cron to store bits of randomness which are +# then used to seed /dev/random on boot. + +# Originally developed by Doug Barton, dougb@FreeBSD.org + +PATH=/bin:/usr/bin + +# If there is a global system configuration file, suck it in. +# +if [ -r /etc/defaults/rc.conf ]; then + . /etc/defaults/rc.conf + source_rc_confs 2>/dev/null +elif [ -r /etc/rc.conf ]; then + . /etc/rc.conf 2>/dev/null +fi + +[ $(/sbin/sysctl -n security.jail.jailed) = 0 ] || exit 0 + +case ${entropy_dir} in +[Nn][Oo]) + exit 0 + ;; +*) + entropy_dir=${entropy_dir:-/var/db/entropy} + ;; +esac + +entropy_save_sz=${entropy_save_sz:-4096} +entropy_save_num=${entropy_save_num:-8} + +if [ ! -d "${entropy_dir}" ]; then + install -d -o operator -g operator -m 0700 "${entropy_dir}" || { + logger -is -t "$0" The entropy directory "${entropy_dir}" does \ + not exist, and cannot be created. Therefore no entropy can \ + be saved.; exit 1; } +fi + +cd "${entropy_dir}" || { + logger -is -t "$0" Cannot cd to the entropy directory: "${entropy_dir}". \ + Entropy file rotation is aborted.; exit 1; } + +for f in saved-entropy.*; do + case "${f}" in saved-entropy.\*) continue ;; esac # No files match + [ ${f#saved-entropy\.} -gt ${entropy_save_num} ] && unlink ${f} +done + +umask 177 + +# Scan slots [1..$entropy_save_num), picking an empty slot or the oldest +# existing file if no empty slot was available. +# +# 1. Find out the first regular file or empty slot (and its serial number) +# +n=1 +while [ ${n} -le ${entropy_save_num} ]; do + save_file="saved-entropy.${n}" + if [ ! -e "${save_file}" -o -f "${save_file}" ]; then + break + else + logger -is -t "$0" \ + "${save_file}" is not a regular file, skipped. + fi + n=$(( ${n} + 1 )) +done +# +# 2. Start from (serial number + 1), and check if the slot is empty +# or is an older regular file, update save_file pointer in either +# case, and break early if we found an empty slot. +# +if [ -f ${save_file} ]; then + n=$(( ${n} + 1 )) + while [ ${n} -le ${entropy_save_num} ]; do + next_file=saved-entropy.${n} + if [ -f "${next_file}" ]; then + [ "${next_file}" -ot "${save_file}" ] && \ + save_file="${next_file}" + elif [ ! -e "${next_file}" ]; then + save_file="${next_file}" + break + else + logger -is -t "$0" \ + "${next_file}" is not a regular file, skipped. + fi + n=$(( ${n} + 1 )) + done +fi +# +# 3. Check if the pointer we have in hand is really a regular file or +# an empty slot, and bail out as that means there is no available slot. +# +if [ -e "${save_file}" -a ! -f "${save_file}" ]; then + logger -is -t "$0" \ + No available slot in "${entropy_dir}", save entropy is aborted. + exit 1 +fi + +# Save entropy to the selected slot. +chmod 600 "${save_file}" 2>/dev/null || : +dd if=/dev/random of="${save_file}" bs=${entropy_save_sz} count=1 2>/dev/null +chflags nodump "${save_file}" 2>/dev/null || : +fsync "${save_file}" "." + +exit 0 |