[Buildroot] [PATCH] move random-seed from /etc to /var/lib

[Buildroot] [PATCH] move random-seed from /etc to /var/lib

[Alex Suykov]

In case / is mounted read-only, /etc is likely to be read-only
as well, so the seed will not be saved.

Other non-static files (mtab, resolve.conf) have already been moved
out of /etc, random-seed is the only volatile file there at present.

Signed-off-by: Alex Suykov <alex.suykov@gmail.com>
---
 system/device_table.txt               |   2 +-
 system/skeleton/etc/init.d/S20urandom |  14 +++++++-------
 system/skeleton/etc/random-seed       | Bin 512 -> 0 bytes
 system/skeleton/var/lib/random-seed   | Bin 0 -> 512 bytes
 4 files changed, 8 insertions(+), 8 deletions(-)
 delete mode 100644 system/skeleton/etc/random-seed
 create mode 100644 system/skeleton/var/lib/random-seed

diff --git a/system/device_table.txt b/system/device_table.txt
index 8e7dbd2..77ecc62 100644
--- a/system/device_table.txt
+++ b/system/device_table.txt
@@ -11,7 +11,7 @@
 /etc					d	755	0	0	-	-	-	-	-
 /root					d	700	0	0	-	-	-	-	-
 /var/www				d	755	33	33	-	-	-	-	-
-/etc/random-seed			f	600	0	0	-	-	-	-	-
+/var/lib/random-seed			f	600	0	0	-	-	-	-	-
 /etc/shadow				f	600	0	0	-	-	-	-	-
 /etc/passwd				f	644	0	0	-	-	-	-	-
 /etc/network/if-up.d			d	755	0	0	-	-	-	-	-
diff --git a/system/skeleton/etc/init.d/S20urandom b/system/skeleton/etc/init.d/S20urandom
index f73cea5..f95b47d 100755
--- a/system/skeleton/etc/init.d/S20urandom
+++ b/system/skeleton/etc/init.d/S20urandom
@@ -17,25 +17,25 @@ case "$1" in
 		fi
 		# Load and then save 512 bytes,
 		# which is the size of the entropy pool
-		if [ -f /etc/random-seed ]
+		if [ -f /var/lib/random-seed ]
 		then
-			cat /etc/random-seed >/dev/urandom
+			cat /var/lib/random-seed >/dev/urandom
 		fi
 		# check for read only file system
-		if ! touch /etc/random-seed 2>/dev/null
+		if ! touch /var/lib/random-seed 2>/dev/null
 		then
 			echo "read-only file system detected...done"
 			exit
 		fi
-		rm -f /etc/random-seed
+		rm -f /var/lib/random-seed
 		umask 077
-		dd if=/dev/urandom of=/etc/random-seed count=1 \
+		dd if=/dev/urandom of=/var/lib/random-seed count=1 \
 			>/dev/null 2>&1 || echo "urandom start: failed."
 		umask 022
 		[ "$VERBOSE" != no ] && echo "done."
 		;;
 	stop)
-		if ! touch /etc/random-seed 2>/dev/null
+		if ! touch /var/lib/random-seed 2>/dev/null
                 then
                         exit
                 fi
@@ -43,7 +43,7 @@ case "$1" in
 		# see documentation in linux/drivers/char/random.c
 		[ "$VERBOSE" != no ] && echo -n "Saving random seed... "
 		umask 077
-		dd if=/dev/urandom of=/etc/random-seed count=1 \
+		dd if=/dev/urandom of=/var/lib/random-seed count=1 \
 			>/dev/null 2>&1 || echo "urandom stop: failed."
 		[ "$VERBOSE" != no ] && echo "done."
 		;;
diff --git a/system/skeleton/etc/random-seed b/system/skeleton/etc/random-seed
deleted file mode 100644
index f26038adc5d057a0b9d6ce5d3cda02ccb4a4d12e..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 512
zcmV+b0{{Iq0UOB42;n<rZ7)sf8Kr=fg87_s+y&vLYgGJP-sY`OWMEj0aQ&I{*g5$)
zH?Zu5*rX8>4xpAvJIL$H4mg*!B4&9jh)7+B2j-fX7o at K*bzj;pJ$FwoQzl&MuZ^Wy
zrYS)x9vq<)#e~&1uB|_ITW-fntEg1^KXs3>vvgL7?_kg!+6=fg{S7mwkr$#pm<zB(
zu)oAUWFK-u-)cWcuSL*8$Q<cmC?ll~NEK@l5k|75(YzZ_p!I6FJ}YI_3>PZ13liCc
zi|M+im&71p*p+Z|7f(m-aedNFtEezFN<xKEd-wQ71%XuGfKr+6VcDycMQ(v6+Z0G|
z-MPjg@JHu%y(|h1cTa=a4(m?GyU)ZD-T+-vLXX}cCXyn}vCXC3Hn1ft`zDTL(};Rr
z?3wX?Eh5%n+AXAeDtXvl!o>-nZHytAhV~}?OM$-f$(%cG(ioV{==Ub4mfZP}OaJJ7
z25tvCcku=>;L?}O-dvK9`}<^gmg@IrnfQm#P>RRF|C9c;GDgEg_bw26{dkIVt1`{`
z3#ol{Q_FL91TBD~{uZn<gw?^=VUuSaIf)=p`07n=>RRZ(Otf!KXM&;q)8B<Q8(T)k
z?Z}a{1Jyf~bQPL{qVQk6jFNfBr)0;57HwN`o6Kw{wdPGHUWrfsJ}0VmW|Tr22whlO
C+W_DI

diff --git a/system/skeleton/var/lib/random-seed b/system/skeleton/var/lib/random-seed
new file mode 100644
index 0000000000000000000000000000000000000000..f26038adc5d057a0b9d6ce5d3cda02ccb4a4d12e
GIT binary patch
literal 512
zcmV+b0{{Iq0UOB42;n<rZ7)sf8Kr=fg87_s+y&vLYgGJP-sY`OWMEj0aQ&I{*g5$)
zH?Zu5*rX8>4xpAvJIL$H4mg*!B4&9jh)7+B2j-fX7o at K*bzj;pJ$FwoQzl&MuZ^Wy
zrYS)x9vq<)#e~&1uB|_ITW-fntEg1^KXs3>vvgL7?_kg!+6=fg{S7mwkr$#pm<zB(
zu)oAUWFK-u-)cWcuSL*8$Q<cmC?ll~NEK@l5k|75(YzZ_p!I6FJ}YI_3>PZ13liCc
zi|M+im&71p*p+Z|7f(m-aedNFtEezFN<xKEd-wQ71%XuGfKr+6VcDycMQ(v6+Z0G|
z-MPjg@JHu%y(|h1cTa=a4(m?GyU)ZD-T+-vLXX}cCXyn}vCXC3Hn1ft`zDTL(};Rr
z?3wX?Eh5%n+AXAeDtXvl!o>-nZHytAhV~}?OM$-f$(%cG(ioV{==Ub4mfZP}OaJJ7
z25tvCcku=>;L?}O-dvK9`}<^gmg@IrnfQm#P>RRF|C9c;GDgEg_bw26{dkIVt1`{`
z3#ol{Q_FL91TBD~{uZn<gw?^=VUuSaIf)=p`07n=>RRZ(Otf!KXM&;q)8B<Q8(T)k
z?Z}a{1Jyf~bQPL{qVQk6jFNfBr)0;57HwN`o6Kw{wdPGHUWrfsJ}0VmW|Tr22whlO
C+W_DI

literal 0
HcmV?d00001

-- 
2.0.3

[Buildroot] [PATCH] move random-seed from /etc to /var/lib

[Peter Korsgaard]

>>>>> "Alex" == Alex Suykov <alex.suykov@gmail.com> writes:

 > In case / is mounted read-only, /etc is likely to be read-only
 > as well, so the seed will not be saved.

But if rootfs is RO, so will /var/lib then?

I would rather get rid of the static random_seed file instead. Seeding
all Buildroot based devices with a RO rootfs from the same 512 bytes of
data can hardly be helpful for security.

For a R/W rootfs, why would /var/lib be any better than /etc?

-- 
Bye, Peter Korsgaard

[Buildroot] [PATCH] move random-seed from /etc to /var/lib

[Gustavo Zacarias]

On 03/12/2015 08:01 PM, Peter Korsgaard wrote:

> But if rootfs is RO, so will /var/lib then?
> 
> I would rather get rid of the static random_seed file instead. Seeding
> all Buildroot based devices with a RO rootfs from the same 512 bytes of
> data can hardly be helpful for security.
> 
> For a R/W rootfs, why would /var/lib be any better than /etc?

I'm still planning to revap the random initscript and throw some infra
there.
Who says we can't use /etc/default + /etc/config for this? We can tell
where to write randomness if it's available that way.
On the project side we can choose if we'll use a per-project (build
time) random seed or nothing at all, after all we can't know every
scenario out there.
Regards.

[Buildroot] [PATCH] move random-seed from /etc to /var/lib

[Peter Korsgaard]

>>>>> "Gustavo" == Gustavo Zacarias <gustavo@zacarias.com.ar> writes:

 > On 03/12/2015 08:01 PM, Peter Korsgaard wrote:
 >> But if rootfs is RO, so will /var/lib then?
 >> 
 >> I would rather get rid of the static random_seed file instead. Seeding
 >> all Buildroot based devices with a RO rootfs from the same 512 bytes of
 >> data can hardly be helpful for security.
 >> 
 >> For a R/W rootfs, why would /var/lib be any better than /etc?

 > I'm still planning to revap the random initscript and throw some infra
 > there.
 > Who says we can't use /etc/default + /etc/config for this? We can tell
 > where to write randomness if it's available that way.
 > On the project side we can choose if we'll use a per-project (build
 > time) random seed or nothing at all, after all we can't know every
 > scenario out there.

Ok, but simply doing a git rm system/skeleton/etc/random-seed would be a
good start (and shouldn't cause issues for any of those features).

-- 
Bye, Peter Korsgaard 

[Buildroot] [PATCH] move random-seed from /etc to /var/lib

[Alex Suykov]

Fri, Mar 13, 2015 at 12:01:28AM +0100, Peter Korsgaard wrote:

> >>>>> "Alex" == Alex Suykov <alex.suykov@gmail.com> writes:
> 
>  > In case / is mounted read-only, /etc is likely to be read-only
>  > as well, so the seed will not be saved.
> 
> But if rootfs is RO, so will /var/lib then?
Common (I think?) setup is to have ro / and rw /var on some
kind of persistent storage. This way /etc typically remains
a part of read-only root.

Buildroot does not support such layout at present but with /etc/mtab
and /etc/resolv.conf already out of /etc, it's one step away.

> I would rather get rid of the static random_seed file instead. Seeding
> all Buildroot based devices with a RO rootfs from the same 512 bytes of
> data can hardly be helpful for security.
Agreed. Currently the initial file is only used to check for rw filesystem.
That's not necessary, and easy to fix. Sending a patch.

[Buildroot] [PATCH] move random-seed from /etc to /var/lib

[Peter Korsgaard]

>>>>> "Alex" == Alex Suykov <alex.suykov@gmail.com> writes:

 >> > In case / is mounted read-only, /etc is likely to be read-only
 >> > as well, so the seed will not be saved.
 >> 
 >> But if rootfs is RO, so will /var/lib then?
 > Common (I think?) setup is to have ro / and rw /var on some
 > kind of persistent storage. This way /etc typically remains
 > a part of read-only root.

I don't know how common this is. Projects I've worked with have done the
opposite (RO rootfs with a R/W overlay on top of /etc).

 >> I would rather get rid of the static random_seed file instead. Seeding
 >> all Buildroot based devices with a RO rootfs from the same 512 bytes of
 >> data can hardly be helpful for security.

> Agreed. Currently the initial file is only used to check for rw filesystem.
 > That's not necessary, and easy to fix. Sending a patch.

Not only that - If you have a RO /etc then the system gets initialized
with the "our" seed on every boot.

-- 
Bye, Peter Korsgaard