Home | History | Annotate | Line # | Download | only in rc.d
random_seed revision 1.11 
      1 #!/bin/sh
      2 #
      3 # $NetBSD: random_seed,v 1.11 2020/05/07 18:15:29 riastradh Exp $
      4 #
      5 
      6 # PROVIDE: random_seed
      7 # REQUIRE: mountcritlocal
      8 # BEFORE: securelevel
      9 # BEFORE: bootconf
     10 # KEYWORD: shutdown
     11 #
     12 # The "BEFORE: securelevel" is a real dependency, in that
     13 # this script won't work if run after the securelevel is changed.
     14 #
     15 # The "BEFORE: bootconf" is intended to cause this to
     16 # be the first script that runs after mountcritlocal.
     17 
     18 $_rc_subr_loaded . /etc/rc.subr
     19 
     20 name="random_seed"
     21 rcvar=$name
     22 start_cmd="random_load"
     23 stop_cmd="random_save"
     24 
     25 random_file="${random_file:-/var/db/entropy-file}"
     26 
     27 message()
     28 {
     29 	echo "${name}: ${random_file}: $@" 1>&2
     30 }
     31 
     32 fs_safe()
     33 {
     34 	# Consider the root file system safe always.
     35 	df -P "$1" | (while read dev total used avail cap mountpoint; do
     36 		case $mountpoint in
     37 		'Mounted on')	continue;;
     38 		/)		exit 0;;
     39 		*)		exit 1;;
     40 		esac
     41 	done) && return 0
     42 
     43 	# Otherwise, consider local file systems safe and non-local
     44 	# file systems unsafe.
     45 	case $(df -l "$1") in
     46 	*Warning:*)
     47 		return 1
     48 		;;
     49 	*)
     50 		return 0
     51 		;;
     52 	esac
     53 }
     54 
     55 random_load()
     56 {
     57 	local flags=
     58 
     59 	if [ ! -f "${random_file}" ]; then
     60 		message "Not present"
     61 		return
     62 	fi
     63 
     64 	if ! fs_safe "${random_file}"; then
     65 		message "Unsafe file system for random seed ${random_file}"
     66 		flags=-i
     67 	fi
     68 
     69 	set -- $(ls -ldn "${random_file}")
     70 	st_mode="$1" # should be "-rw-------"
     71 	st_uid="$3"  # should be "0" for root
     72 
     73 	# The file must be owned by root,
     74 	if [ "$st_uid" != "0" ]; then
     75 		message "Bad owner ${st_uid}"
     76 		flags=-i
     77 	fi
     78 	# and root read/write only.
     79 	if [ "$st_mode" != "-rw-------" ]; then
     80 		message "Bad mode ${st_mode}"
     81 		flags=-i
     82 	fi
     83 
     84 	if rndctl $flags -L "${random_file}"; then
     85 		echo "Loaded entropy from ${random_file}."
     86 	fi
     87 }
     88 
     89 random_save()
     90 {
     91 	oum="$(umask)"
     92 	umask 077
     93 
     94 	if rndctl -S "${random_file}"; then
     95 		echo "Saved entropy to ${random_file}."
     96 	fi
     97 	umask "${oum}"
     98 }
     99 
    100 
    101 load_rc_config "${name}"
    102 run_rc_command "$1"
    103