blob: bc6ae5cb4960cf5540a608734dba3e766e0239e0 [file] [log] [blame]
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +02001// SPDX-License-Identifier: GPL-2.0 OR MIT
2/*
3 * Copyright (C) 2022 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
4 *
Jason A. Donenfeld31ec4812022-04-20 15:27:29 +02005 * SeedRNG is a simple program made for seeding the Linux kernel random number
6 * generator from seed files. It is is useful in light of the fact that the
7 * Linux kernel RNG cannot be initialized from shell scripts, and new seeds
8 * cannot be safely generated from boot time shell scripts either. It should
9 * be run once at init time and once at shutdown time. It can be run at other
10 * times on a timer as well. Whenever it is run, it writes existing seed files
11 * into the RNG pool, and then creates a new seed file. If the RNG is
12 * initialized at the time of creating a new seed file, then that new seed file
13 * is marked as "creditable", which means it can be used to initialize the RNG.
14 * Otherwise, it is marked as "non-creditable", in which case it is still used
15 * to seed the RNG's pool, but will not initialize the RNG. In order to ensure
16 * that entropy only ever stays the same or increases from one seed file to the
17 * next, old seed values are hashed together with new seed values when writing
18 * new seed files.
19 *
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +020020 * This is based on code from <https://git.zx2c4.com/seedrng/about/>.
21 */
22
23//config:config SEEDRNG
Jason A. Donenfeld398bb382022-04-20 15:34:20 +020024//config: bool "seedrng (2.1 kb)"
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +020025//config: default y
26//config: help
27//config: Seed the kernel RNG from seed files, meant to be called
28//config: once during startup, once during shutdown, and optionally
29//config: at some periodic interval in between.
30
31//applet:IF_SEEDRNG(APPLET(seedrng, BB_DIR_USR_SBIN, BB_SUID_DROP))
32
33//kbuild:lib-$(CONFIG_SEEDRNG) += seedrng.o
34
35//usage:#define seedrng_trivial_usage
Jason A. Donenfeld398bb382022-04-20 15:34:20 +020036//usage: "[-d SEED_DIRECTORY] [-n]"
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +020037//usage:#define seedrng_full_usage "\n\n"
38//usage: "Seed the kernel RNG from seed files."
39//usage: "\n"
40//usage: "\n -d, --seed-dir DIR Use seed files from specified directory (default: /var/lib/seedrng)"
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +020041//usage: "\n -n, --skip-credit Skip crediting seeds, even if creditable"
42
43#include "libbb.h"
44
45#include <linux/random.h>
46#include <sys/random.h>
47#include <sys/ioctl.h>
48#include <sys/file.h>
49#include <sys/stat.h>
50#include <sys/types.h>
51#include <fcntl.h>
52#include <poll.h>
53#include <unistd.h>
54#include <time.h>
55#include <errno.h>
56#include <endian.h>
57#include <stdbool.h>
58#include <stdint.h>
59#include <string.h>
60#include <stdio.h>
61#include <stdlib.h>
62
63#ifndef GRND_INSECURE
64#define GRND_INSECURE 0x0004 /* Apparently some headers don't ship with this yet. */
65#endif
66
Jason A. Donenfeld45385782022-04-20 15:22:55 +020067#define DEFAULT_SEED_DIR "/var/lib/seedrng"
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +020068#define CREDITABLE_SEED_NAME "seed.credit"
69#define NON_CREDITABLE_SEED_NAME "seed.no-credit"
70
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +020071enum seedrng_lengths {
Jason A. Donenfeld45385782022-04-20 15:22:55 +020072 MIN_SEED_LEN = SHA256_OUTSIZE,
73 MAX_SEED_LEN = 512
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +020074};
75
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +020076static size_t determine_optimal_seed_len(void)
77{
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +020078 char poolsize_str[11] = { 0 };
Jason A. Donenfeld31ec4812022-04-20 15:27:29 +020079 unsigned long poolsize;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +020080
Jason A. Donenfeld45385782022-04-20 15:22:55 +020081 if (open_read_close("/proc/sys/kernel/random/poolsize", poolsize_str, sizeof(poolsize_str) - 1) < 0) {
82 bb_perror_msg("unable to determine pool size, falling back to %u bits", MIN_SEED_LEN * 8);
83 return MIN_SEED_LEN;
84 }
Jason A. Donenfeld31ec4812022-04-20 15:27:29 +020085 poolsize = (bb_strtoul(poolsize_str, NULL, 10) + 7) / 8;
86 return MAX(MIN(poolsize, MAX_SEED_LEN), MIN_SEED_LEN);
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +020087}
88
89static int read_new_seed(uint8_t *seed, size_t len, bool *is_creditable)
90{
91 ssize_t ret;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +020092
93 *is_creditable = false;
94 ret = getrandom(seed, len, GRND_NONBLOCK);
95 if (ret == (ssize_t)len) {
96 *is_creditable = true;
97 return 0;
98 } else if (ret < 0 && errno == ENOSYS) {
99 struct pollfd random_fd = {
100 .fd = open("/dev/random", O_RDONLY),
101 .events = POLLIN
102 };
103 if (random_fd.fd < 0)
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200104 return -1;
105 *is_creditable = safe_poll(&random_fd, 1, 0) == 1;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200106 close(random_fd.fd);
107 } else if (getrandom(seed, len, GRND_INSECURE) == (ssize_t)len)
108 return 0;
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200109 if (open_read_close("/dev/urandom", seed, len) == (ssize_t)len)
110 return 0;
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200111 return -1;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200112}
113
114static int seed_rng(uint8_t *seed, size_t len, bool credit)
115{
116 struct {
117 int entropy_count;
118 int buf_size;
119 uint8_t buffer[MAX_SEED_LEN];
120 } req = {
121 .entropy_count = credit ? len * 8 : 0,
122 .buf_size = len
123 };
124 int random_fd, ret;
125
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200126 if (len > sizeof(req.buffer)) {
127 errno = EFBIG;
128 return -1;
129 }
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200130 memcpy(req.buffer, seed, len);
131
132 random_fd = open("/dev/random", O_RDWR);
133 if (random_fd < 0)
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200134 return -1;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200135 ret = ioctl(random_fd, RNDADDENTROPY, &req);
136 if (ret)
137 ret = -errno ? -errno : -EIO;
Jason A. Donenfeld31ec4812022-04-20 15:27:29 +0200138 if (ENABLE_FEATURE_CLEAN_UP)
139 close(random_fd);
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200140 errno = -ret;
141 return ret ? -1 : 0;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200142}
143
Jason A. Donenfeld3c607112022-04-20 15:31:01 +0200144static int seed_from_file_if_exists(const char *filename, int dfd, bool credit, sha256_ctx_t *hash)
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200145{
146 uint8_t seed[MAX_SEED_LEN];
147 ssize_t seed_len;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200148
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200149 seed_len = open_read_close(filename, seed, sizeof(seed));
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200150 if (seed_len < 0) {
Jason A. Donenfeld398bb382022-04-20 15:34:20 +0200151 if (errno == ENOENT)
152 return 0;
153 bb_simple_perror_msg("unable to read seed file");
154 return -1;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200155 }
156 if ((unlink(filename) < 0 || fsync(dfd) < 0) && seed_len) {
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200157 bb_simple_perror_msg("unable to remove seed after reading, so not seeding");
Jason A. Donenfeld398bb382022-04-20 15:34:20 +0200158 return -1;
159 } else if (!seed_len)
160 return 0;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200161
162 sha256_hash(hash, &seed_len, sizeof(seed_len));
163 sha256_hash(hash, seed, seed_len);
164
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200165 printf("Seeding %zd bits %s crediting\n", seed_len * 8, credit ? "and" : "without");
Jason A. Donenfeld398bb382022-04-20 15:34:20 +0200166 if (seed_rng(seed, seed_len, credit) < 0) {
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200167 bb_simple_perror_msg("unable to seed");
Jason A. Donenfeld398bb382022-04-20 15:34:20 +0200168 return -1;
169 }
170 return 0;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200171}
172
173int seedrng_main(int argc, char *argv[]) MAIN_EXTERNALLY_VISIBLE;
174int seedrng_main(int argc UNUSED_PARAM, char *argv[])
175{
176 static const char seedrng_prefix[] = "SeedRNG v1 Old+New Prefix";
177 static const char seedrng_failure[] = "SeedRNG v1 No New Seed Failure";
Jason A. Donenfeld398bb382022-04-20 15:34:20 +0200178 char *seed_dir, *creditable_seed, *non_creditable_seed;
179 int ret, fd = -1, dfd = -1, program_ret = 0;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200180 uint8_t new_seed[MAX_SEED_LEN];
181 size_t new_seed_len;
182 bool new_seed_creditable;
183 bool skip_credit = false;
Jason A. Donenfeld31ec4812022-04-20 15:27:29 +0200184 struct timespec timestamp = { 0 };
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200185 sha256_ctx_t hash;
186
187 int opt;
188 enum {
189 OPT_d = (1 << 0),
Jason A. Donenfeld398bb382022-04-20 15:34:20 +0200190 OPT_n = (1 << 1)
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200191 };
192#if ENABLE_LONG_OPTS
193 static const char longopts[] ALIGN1 =
194 "seed-dir\0" Required_argument "d"
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200195 "skip-credit\0" No_argument "n"
196 ;
197#endif
198
Jason A. Donenfeld398bb382022-04-20 15:34:20 +0200199 opt = getopt32long(argv, "d:n", longopts, &seed_dir);
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200200 if (!(opt & OPT_d) || !seed_dir)
201 seed_dir = xstrdup(DEFAULT_SEED_DIR);
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200202 skip_credit = opt & OPT_n;
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200203 creditable_seed = concat_path_file(seed_dir, CREDITABLE_SEED_NAME);
204 non_creditable_seed = concat_path_file(seed_dir, NON_CREDITABLE_SEED_NAME);
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200205
206 umask(0077);
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200207 if (getuid())
208 bb_simple_error_msg_and_die("this program requires root");
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200209
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200210 if (mkdir(seed_dir, 0700) < 0 && errno != EEXIST)
211 bb_simple_perror_msg_and_die("unable to create seed directory");
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200212
Jason A. Donenfeld3c607112022-04-20 15:31:01 +0200213 dfd = open(seed_dir, O_DIRECTORY | O_RDONLY);
Jason A. Donenfeld398bb382022-04-20 15:34:20 +0200214 if (dfd < 0 || flock(dfd, LOCK_EX) < 0) {
215 bb_simple_perror_msg("unable to open and lock seed directory");
Jason A. Donenfeld3c607112022-04-20 15:31:01 +0200216 program_ret = 1;
217 goto out;
218 }
219
Jason A. Donenfeld31ec4812022-04-20 15:27:29 +0200220 sha256_begin(&hash);
221 sha256_hash(&hash, seedrng_prefix, strlen(seedrng_prefix));
222 clock_gettime(CLOCK_REALTIME, &timestamp);
223 sha256_hash(&hash, &timestamp, sizeof(timestamp));
224 clock_gettime(CLOCK_BOOTTIME, &timestamp);
225 sha256_hash(&hash, &timestamp, sizeof(timestamp));
226
Jason A. Donenfeld3c607112022-04-20 15:31:01 +0200227 ret = seed_from_file_if_exists(non_creditable_seed, dfd, false, &hash);
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200228 if (ret < 0)
229 program_ret |= 1 << 1;
Jason A. Donenfeld3c607112022-04-20 15:31:01 +0200230 ret = seed_from_file_if_exists(creditable_seed, dfd, !skip_credit, &hash);
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200231 if (ret < 0)
232 program_ret |= 1 << 2;
233
234 new_seed_len = determine_optimal_seed_len();
235 ret = read_new_seed(new_seed, new_seed_len, &new_seed_creditable);
236 if (ret < 0) {
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200237 bb_simple_perror_msg("unable to read new seed");
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200238 new_seed_len = SHA256_OUTSIZE;
239 strncpy((char *)new_seed, seedrng_failure, new_seed_len);
240 program_ret |= 1 << 3;
241 }
242 sha256_hash(&hash, &new_seed_len, sizeof(new_seed_len));
243 sha256_hash(&hash, new_seed, new_seed_len);
244 sha256_end(&hash, new_seed + new_seed_len - SHA256_OUTSIZE);
245
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200246 printf("Saving %zu bits of %s seed for next boot\n", new_seed_len * 8, new_seed_creditable ? "creditable" : "non-creditable");
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200247 fd = open(non_creditable_seed, O_WRONLY | O_CREAT | O_TRUNC, 0400);
Jason A. Donenfeld398bb382022-04-20 15:34:20 +0200248 if (fd < 0 || full_write(fd, new_seed, new_seed_len) != (ssize_t)new_seed_len || fsync(fd) < 0) {
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200249 bb_simple_perror_msg("unable to write seed file");
Jason A. Donenfeld398bb382022-04-20 15:34:20 +0200250 program_ret |= 1 << 4;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200251 goto out;
252 }
253 if (new_seed_creditable && rename(non_creditable_seed, creditable_seed) < 0) {
Jason A. Donenfeld45385782022-04-20 15:22:55 +0200254 bb_simple_perror_msg("unable to make new seed creditable");
Jason A. Donenfeld398bb382022-04-20 15:34:20 +0200255 program_ret |= 1 << 5;
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200256 }
257out:
Jason A. Donenfeld31ec4812022-04-20 15:27:29 +0200258 if (ENABLE_FEATURE_CLEAN_UP && fd >= 0)
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200259 close(fd);
Jason A. Donenfeld3c607112022-04-20 15:31:01 +0200260 if (ENABLE_FEATURE_CLEAN_UP && dfd >= 0)
261 close(dfd);
Jason A. Donenfeld4b407ba2022-04-04 18:21:51 +0200262 return program_ret;
263}