From a33478d56364e928de95f21bc70e72a43d8c5445 Mon Sep 17 00:00:00 2001
From: Joachim Nilsson <troglobit@gmail.com>
Date: Mon, 26 Oct 2015 03:16:45 +0100
Subject: [PATCH] Improve urandom plugin for embedded systems w/o random seed.

For embedded systems with no initial random seed, usually stored in
/var/lib/urandom/urandom-seed on desktops, servers and laptops, we now
provide an initial seed file using a built-in PRNG.

Also, let the configure script default to *enable* the random seeding
at boot, granted the urandom plugin is enabled.  We should encourage
users to properly seed their random, for security reasons.

Moreover, the plugin did not properly regenerate the random seed on
reboot, or shutdown, this patch also rectifies that problem.

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>
---
 configure          |  7 ++++---
 plugins/bootmisc.c |  2 ++
 plugins/urandom.c  | 50 ++++++++++++++++++++++++++++++++++++++--------
 3 files changed, 48 insertions(+), 11 deletions(-)

diff --git a/configure b/configure
index a7a1a0c4..67866505 100755
--- a/configure
+++ b/configure
@@ -22,6 +22,7 @@ defaults()
         plugindir=${plugindir:="$libdir/$pdir"}
         # The initctl FIFO, should probably be in /run, not /dev
         fifo=${fifo:="/dev/initctl"}
+        random=${random:="/var/lib/urandom/random-seed"}
         conf="finit.conf"
         config=${config:="$sysconfdir/$conf"}
         confdir=${confdir:="finit.d"}
@@ -149,9 +150,9 @@ usage()
         echo "  --with-fifo=FIFO       FIFO for initctl plugin, default '$fifo'"
         echo "  --with-config=CONFIG   Finit CONFIG file, default '\$sysconfdir/$conf'"
         echo "  --with-heading=GREET   Display GREET instead of Finit version at boot"
-        echo "  --with-randomseed=SEED Seed /dev/urandom from file SEED.  On Debian/Ubuntu"
-        echo "                         systems, set this to /var/lib/urandom/random-seed"
-        echo "                         Default: none"
+        echo "  --with-randomseed=SEED Seed /dev/urandom at boot from SEED.  Usually found in"
+        echo "                         standard Linux systems at $random"
+        echo "                         which is also the default.  Requires urandom plugin!"
         echo "  --with-plugins=\"a b c\" Build plugins 'a', 'b' and 'c', either as dynamic .so"
         echo "                         files, or as built-in if --enable-static is given,"
         echo "                         defaults to all plugins.  Exclude extension!"
diff --git a/plugins/bootmisc.c b/plugins/bootmisc.c
index 3e172732..437f04f6 100644
--- a/plugins/bootmisc.c
+++ b/plugins/bootmisc.c
@@ -24,6 +24,7 @@
 #include <string.h>
 #include <utmp.h>
 
+#include "../config.h"
 #include "../finit.h"
 #include "../helpers.h"
 #include "../plugin.h"
@@ -45,6 +46,7 @@ static void setup(void *UNUSED(arg))
 	makedir("/var/lib",        0755);
 	makedir("/var/lib/misc",   0755);
 	makedir("/var/lib/alarm",  0755);
+	makedir("/var/lib/urandom",0755);
 	makedir("/var/lock",       0755);
 	makedir("/var/log",        0755);
 	makedir("/var/mail",       0755);
diff --git a/plugins/urandom.c b/plugins/urandom.c
index f58d1332..fd6a2610 100644
--- a/plugins/urandom.c
+++ b/plugins/urandom.c
@@ -22,29 +22,63 @@
  */
 
 #include <unistd.h>
-#include <sys/types.h>
 #include <sys/stat.h>
+#include <sys/time.h>		/* gettimeofday() */
+#include <sys/types.h>
 
+#include "../config.h"
 #include "../finit.h"
-#include "libite/lite.h"
 #include "../helpers.h"
 #include "../plugin.h"
+#include "libite/lite.h"
 
 static void setup(void *UNUSED(arg))
 {
 #ifdef RANDOMSEED
-	copyfile(RANDOMSEED, "/dev/urandom", 0, 0);
-	unlink(RANDOMSEED);
+	if (!fexist(RANDOMSEED)) {
+		int ret = 1;
+		FILE *fp;
+
+		print_desc("Bootstrapping random seed", NULL);
+		umask(077);
+		fp = fopen(RANDOMSEED, "w");
+		if (fp) {
+			int iter = 128;
+			struct timeval tv;
+
+			gettimeofday(&tv, NULL);
+			srandom(tv.tv_sec % 3600);
+			while (iter--) {
+				uint32_t i, prng = random();
+
+				for (i = 0; i < sizeof(prng); i++)
+					fputc((prng >> (i * CHAR_BIT)) & UCHAR_MAX, fp);
+			}
+			ret = fclose(fp);
+		}
+		print_result(ret);
+		umask(0);
+	}
+
+	print_desc("Initializing random number generator", NULL);
+	print_result(512 != copyfile(RANDOMSEED, "/dev/urandom", 0, 0));
+#endif
+}
+
+static void save(void *UNUSED(arg))
+{
+#ifdef RANDOMSEED
 	umask(077);
-	copyfile("/dev/urandom", RANDOMSEED, 4096, 0);
+	print_desc("Saving random seed", NULL);
+	print_result(512 != copyfile("/dev/urandom", RANDOMSEED, 512, 0));
 	umask(0);
 #endif
 }
 
 static plugin_t plugin = {
-	.hook[HOOK_BASEFS_UP] = {
-		.cb  = setup
-	},
+	.name = "urandom",
+	.hook[HOOK_BASEFS_UP] = { .cb  = setup },
+	.hook[HOOK_SHUTDOWN]  = { .cb  = save  },
 	.depends = { "bootmisc", }
 };