GNU bug report logs - #23605
/dev/urandom not seeded across reboots

Previous Next

Full log

View this message in rfc822 format

From: ludo <at> gnu.org (Ludovic Courtès)
To: Leo Famulari <leo <at> famulari.name>
Cc: 23605 <at> debbugs.gnu.org
Subject: bug#23605: /dev/urandom not seeded across reboots
Date: Sat, 28 May 2016 15:51:58 +0200

Leo Famulari <leo <at> famulari.name> skribis:

> On Tue, May 24, 2016 at 02:24:59PM +0200, Ludovic Courtès wrote:
>> Leo Famulari <leo <at> famulari.name> skribis:
>> 
>> > I realized that we don't seem to be saving any of the entropy in the
>> > kernel's random pool [0] across reboots.
>> >
>> > This means that for some period after boot, /dev/urandom may not be safe
>> > to use. From random(4):
>> 
>> Good catch!
>> 
>> Some comments:
>> 
>> > +(define %urandom-seed-activation
>> > +  ;; Activation gexp for the urandom seed
>> > +  #~(begin
>> > +      (use-modules (guix build utils))
>> > +
>> > +      (mkdir-p "/var/run")
>> > +      (close-port (open-file "/var/run/urandom-seed" "a0b"))
>> 
>> Or simply ‘open-output-file’.
>
> I don't see a way to use (open-output-file) in "append" mode as with
> (open-file).  Without that, the file is cleared before it is read in the
> following lines.

You’re right, sorry for the confusion.

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.