Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0 OR MIT |
| 2 | /* |
| 3 | * Copyright (C) 2022 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved. |
| 4 | * |
Jason A. Donenfeld | 31ec481 | 2022-04-20 15:27:29 +0200 | [diff] [blame] | 5 | * SeedRNG is a simple program made for seeding the Linux kernel random number |
| 6 | * generator from seed files. It is is useful in light of the fact that the |
| 7 | * Linux kernel RNG cannot be initialized from shell scripts, and new seeds |
| 8 | * cannot be safely generated from boot time shell scripts either. It should |
| 9 | * be run once at init time and once at shutdown time. It can be run at other |
| 10 | * times on a timer as well. Whenever it is run, it writes existing seed files |
| 11 | * into the RNG pool, and then creates a new seed file. If the RNG is |
| 12 | * initialized at the time of creating a new seed file, then that new seed file |
| 13 | * is marked as "creditable", which means it can be used to initialize the RNG. |
| 14 | * Otherwise, it is marked as "non-creditable", in which case it is still used |
| 15 | * to seed the RNG's pool, but will not initialize the RNG. In order to ensure |
| 16 | * that entropy only ever stays the same or increases from one seed file to the |
| 17 | * next, old seed values are hashed together with new seed values when writing |
| 18 | * new seed files. |
| 19 | * |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 20 | * This is based on code from <https://git.zx2c4.com/seedrng/about/>. |
| 21 | */ |
| 22 | |
| 23 | //config:config SEEDRNG |
Jason A. Donenfeld | 3cb40f8 | 2022-04-20 15:38:46 +0200 | [diff] [blame] | 24 | //config: bool "seedrng (2 kb)" |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 25 | //config: default y |
| 26 | //config: help |
| 27 | //config: Seed the kernel RNG from seed files, meant to be called |
| 28 | //config: once during startup, once during shutdown, and optionally |
| 29 | //config: at some periodic interval in between. |
| 30 | |
| 31 | //applet:IF_SEEDRNG(APPLET(seedrng, BB_DIR_USR_SBIN, BB_SUID_DROP)) |
| 32 | |
| 33 | //kbuild:lib-$(CONFIG_SEEDRNG) += seedrng.o |
| 34 | |
| 35 | //usage:#define seedrng_trivial_usage |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 36 | //usage: "[-d SEED_DIRECTORY] [-n]" |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 37 | //usage:#define seedrng_full_usage "\n\n" |
| 38 | //usage: "Seed the kernel RNG from seed files." |
| 39 | //usage: "\n" |
| 40 | //usage: "\n -d, --seed-dir DIR Use seed files from specified directory (default: /var/lib/seedrng)" |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 41 | //usage: "\n -n, --skip-credit Skip crediting seeds, even if creditable" |
| 42 | |
| 43 | #include "libbb.h" |
| 44 | |
| 45 | #include <linux/random.h> |
| 46 | #include <sys/random.h> |
| 47 | #include <sys/ioctl.h> |
| 48 | #include <sys/file.h> |
| 49 | #include <sys/stat.h> |
| 50 | #include <sys/types.h> |
| 51 | #include <fcntl.h> |
| 52 | #include <poll.h> |
| 53 | #include <unistd.h> |
| 54 | #include <time.h> |
| 55 | #include <errno.h> |
| 56 | #include <endian.h> |
| 57 | #include <stdbool.h> |
| 58 | #include <stdint.h> |
| 59 | #include <string.h> |
| 60 | #include <stdio.h> |
| 61 | #include <stdlib.h> |
| 62 | |
| 63 | #ifndef GRND_INSECURE |
| 64 | #define GRND_INSECURE 0x0004 /* Apparently some headers don't ship with this yet. */ |
| 65 | #endif |
| 66 | |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 67 | #define DEFAULT_SEED_DIR "/var/lib/seedrng" |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 68 | #define CREDITABLE_SEED_NAME "seed.credit" |
| 69 | #define NON_CREDITABLE_SEED_NAME "seed.no-credit" |
| 70 | |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 71 | enum seedrng_lengths { |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 72 | MIN_SEED_LEN = SHA256_OUTSIZE, |
| 73 | MAX_SEED_LEN = 512 |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 74 | }; |
| 75 | |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 76 | static size_t determine_optimal_seed_len(void) |
| 77 | { |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 78 | char poolsize_str[11] = { 0 }; |
Jason A. Donenfeld | 31ec481 | 2022-04-20 15:27:29 +0200 | [diff] [blame] | 79 | unsigned long poolsize; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 80 | |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 81 | if (open_read_close("/proc/sys/kernel/random/poolsize", poolsize_str, sizeof(poolsize_str) - 1) < 0) { |
Jason A. Donenfeld | ce9a345 | 2022-04-20 15:36:22 +0200 | [diff] [blame] | 82 | bb_perror_msg("unable to determine pool size, assuming %u bits", MIN_SEED_LEN * 8); |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 83 | return MIN_SEED_LEN; |
| 84 | } |
Jason A. Donenfeld | 31ec481 | 2022-04-20 15:27:29 +0200 | [diff] [blame] | 85 | poolsize = (bb_strtoul(poolsize_str, NULL, 10) + 7) / 8; |
| 86 | return MAX(MIN(poolsize, MAX_SEED_LEN), MIN_SEED_LEN); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 87 | } |
| 88 | |
| 89 | static int read_new_seed(uint8_t *seed, size_t len, bool *is_creditable) |
| 90 | { |
| 91 | ssize_t ret; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 92 | |
| 93 | *is_creditable = false; |
| 94 | ret = getrandom(seed, len, GRND_NONBLOCK); |
| 95 | if (ret == (ssize_t)len) { |
| 96 | *is_creditable = true; |
| 97 | return 0; |
| 98 | } else if (ret < 0 && errno == ENOSYS) { |
| 99 | struct pollfd random_fd = { |
| 100 | .fd = open("/dev/random", O_RDONLY), |
| 101 | .events = POLLIN |
| 102 | }; |
| 103 | if (random_fd.fd < 0) |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 104 | return -1; |
| 105 | *is_creditable = safe_poll(&random_fd, 1, 0) == 1; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 106 | close(random_fd.fd); |
| 107 | } else if (getrandom(seed, len, GRND_INSECURE) == (ssize_t)len) |
| 108 | return 0; |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 109 | if (open_read_close("/dev/urandom", seed, len) == (ssize_t)len) |
| 110 | return 0; |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 111 | return -1; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 112 | } |
| 113 | |
| 114 | static int seed_rng(uint8_t *seed, size_t len, bool credit) |
| 115 | { |
| 116 | struct { |
| 117 | int entropy_count; |
| 118 | int buf_size; |
| 119 | uint8_t buffer[MAX_SEED_LEN]; |
| 120 | } req = { |
| 121 | .entropy_count = credit ? len * 8 : 0, |
| 122 | .buf_size = len |
| 123 | }; |
| 124 | int random_fd, ret; |
| 125 | |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 126 | if (len > sizeof(req.buffer)) { |
| 127 | errno = EFBIG; |
| 128 | return -1; |
| 129 | } |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 130 | memcpy(req.buffer, seed, len); |
| 131 | |
Jason A. Donenfeld | 57fea02 | 2022-04-20 15:40:40 +0200 | [diff] [blame^] | 132 | random_fd = open("/dev/urandom", O_RDONLY); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 133 | if (random_fd < 0) |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 134 | return -1; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 135 | ret = ioctl(random_fd, RNDADDENTROPY, &req); |
| 136 | if (ret) |
| 137 | ret = -errno ? -errno : -EIO; |
Jason A. Donenfeld | 31ec481 | 2022-04-20 15:27:29 +0200 | [diff] [blame] | 138 | if (ENABLE_FEATURE_CLEAN_UP) |
| 139 | close(random_fd); |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 140 | errno = -ret; |
| 141 | return ret ? -1 : 0; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 142 | } |
| 143 | |
Jason A. Donenfeld | 3c60711 | 2022-04-20 15:31:01 +0200 | [diff] [blame] | 144 | static int seed_from_file_if_exists(const char *filename, int dfd, bool credit, sha256_ctx_t *hash) |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 145 | { |
| 146 | uint8_t seed[MAX_SEED_LEN]; |
| 147 | ssize_t seed_len; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 148 | |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 149 | seed_len = open_read_close(filename, seed, sizeof(seed)); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 150 | if (seed_len < 0) { |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 151 | if (errno == ENOENT) |
| 152 | return 0; |
Jason A. Donenfeld | 57fea02 | 2022-04-20 15:40:40 +0200 | [diff] [blame^] | 153 | bb_perror_msg("unable to%s seed", " read"); |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 154 | return -1; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 155 | } |
| 156 | if ((unlink(filename) < 0 || fsync(dfd) < 0) && seed_len) { |
Jason A. Donenfeld | 57fea02 | 2022-04-20 15:40:40 +0200 | [diff] [blame^] | 157 | bb_perror_msg("unable to%s seed", " remove"); |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 158 | return -1; |
| 159 | } else if (!seed_len) |
| 160 | return 0; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 161 | |
| 162 | sha256_hash(hash, &seed_len, sizeof(seed_len)); |
| 163 | sha256_hash(hash, seed, seed_len); |
| 164 | |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 165 | printf("Seeding %zd bits %s crediting\n", seed_len * 8, credit ? "and" : "without"); |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 166 | if (seed_rng(seed, seed_len, credit) < 0) { |
Jason A. Donenfeld | 57fea02 | 2022-04-20 15:40:40 +0200 | [diff] [blame^] | 167 | bb_perror_msg("unable to%s seed", ""); |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 168 | return -1; |
| 169 | } |
| 170 | return 0; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 171 | } |
| 172 | |
| 173 | int seedrng_main(int argc, char *argv[]) MAIN_EXTERNALLY_VISIBLE; |
| 174 | int seedrng_main(int argc UNUSED_PARAM, char *argv[]) |
| 175 | { |
Jason A. Donenfeld | 57fea02 | 2022-04-20 15:40:40 +0200 | [diff] [blame^] | 176 | const char *seed_dir = DEFAULT_SEED_DIR, *creditable_seed, *non_creditable_seed; |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 177 | int ret, fd = -1, dfd = -1, program_ret = 0; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 178 | uint8_t new_seed[MAX_SEED_LEN]; |
| 179 | size_t new_seed_len; |
| 180 | bool new_seed_creditable; |
| 181 | bool skip_credit = false; |
Jason A. Donenfeld | 31ec481 | 2022-04-20 15:27:29 +0200 | [diff] [blame] | 182 | struct timespec timestamp = { 0 }; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 183 | sha256_ctx_t hash; |
| 184 | |
| 185 | int opt; |
| 186 | enum { |
| 187 | OPT_d = (1 << 0), |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 188 | OPT_n = (1 << 1) |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 189 | }; |
| 190 | #if ENABLE_LONG_OPTS |
| 191 | static const char longopts[] ALIGN1 = |
| 192 | "seed-dir\0" Required_argument "d" |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 193 | "skip-credit\0" No_argument "n" |
| 194 | ; |
| 195 | #endif |
| 196 | |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 197 | opt = getopt32long(argv, "d:n", longopts, &seed_dir); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 198 | skip_credit = opt & OPT_n; |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 199 | creditable_seed = concat_path_file(seed_dir, CREDITABLE_SEED_NAME); |
| 200 | non_creditable_seed = concat_path_file(seed_dir, NON_CREDITABLE_SEED_NAME); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 201 | |
| 202 | umask(0077); |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 203 | if (getuid()) |
Jason A. Donenfeld | ce9a345 | 2022-04-20 15:36:22 +0200 | [diff] [blame] | 204 | bb_simple_error_msg_and_die(bb_msg_you_must_be_root); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 205 | |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 206 | if (mkdir(seed_dir, 0700) < 0 && errno != EEXIST) |
Jason A. Donenfeld | 57fea02 | 2022-04-20 15:40:40 +0200 | [diff] [blame^] | 207 | bb_perror_msg_and_die("unable to %s seed directory", "create"); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 208 | |
Jason A. Donenfeld | 3c60711 | 2022-04-20 15:31:01 +0200 | [diff] [blame] | 209 | dfd = open(seed_dir, O_DIRECTORY | O_RDONLY); |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 210 | if (dfd < 0 || flock(dfd, LOCK_EX) < 0) { |
Jason A. Donenfeld | 57fea02 | 2022-04-20 15:40:40 +0200 | [diff] [blame^] | 211 | bb_perror_msg("unable to %s seed directory", "lock"); |
Jason A. Donenfeld | 3c60711 | 2022-04-20 15:31:01 +0200 | [diff] [blame] | 212 | program_ret = 1; |
| 213 | goto out; |
| 214 | } |
| 215 | |
Jason A. Donenfeld | 31ec481 | 2022-04-20 15:27:29 +0200 | [diff] [blame] | 216 | sha256_begin(&hash); |
Jason A. Donenfeld | 3cb40f8 | 2022-04-20 15:38:46 +0200 | [diff] [blame] | 217 | sha256_hash(&hash, "SeedRNG v1 Old+New Prefix", 25); |
Jason A. Donenfeld | 31ec481 | 2022-04-20 15:27:29 +0200 | [diff] [blame] | 218 | clock_gettime(CLOCK_REALTIME, ×tamp); |
| 219 | sha256_hash(&hash, ×tamp, sizeof(timestamp)); |
| 220 | clock_gettime(CLOCK_BOOTTIME, ×tamp); |
| 221 | sha256_hash(&hash, ×tamp, sizeof(timestamp)); |
| 222 | |
Jason A. Donenfeld | 3c60711 | 2022-04-20 15:31:01 +0200 | [diff] [blame] | 223 | ret = seed_from_file_if_exists(non_creditable_seed, dfd, false, &hash); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 224 | if (ret < 0) |
| 225 | program_ret |= 1 << 1; |
Jason A. Donenfeld | 3c60711 | 2022-04-20 15:31:01 +0200 | [diff] [blame] | 226 | ret = seed_from_file_if_exists(creditable_seed, dfd, !skip_credit, &hash); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 227 | if (ret < 0) |
| 228 | program_ret |= 1 << 2; |
| 229 | |
| 230 | new_seed_len = determine_optimal_seed_len(); |
| 231 | ret = read_new_seed(new_seed, new_seed_len, &new_seed_creditable); |
| 232 | if (ret < 0) { |
Jason A. Donenfeld | 57fea02 | 2022-04-20 15:40:40 +0200 | [diff] [blame^] | 233 | bb_perror_msg("unable to%s seed", " read new"); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 234 | new_seed_len = SHA256_OUTSIZE; |
Jason A. Donenfeld | 3cb40f8 | 2022-04-20 15:38:46 +0200 | [diff] [blame] | 235 | memset(new_seed, 0, SHA256_OUTSIZE); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 236 | program_ret |= 1 << 3; |
| 237 | } |
| 238 | sha256_hash(&hash, &new_seed_len, sizeof(new_seed_len)); |
| 239 | sha256_hash(&hash, new_seed, new_seed_len); |
| 240 | sha256_end(&hash, new_seed + new_seed_len - SHA256_OUTSIZE); |
| 241 | |
Jason A. Donenfeld | 57fea02 | 2022-04-20 15:40:40 +0200 | [diff] [blame^] | 242 | printf("Saving %zu bits of %screditable seed for next boot\n", new_seed_len * 8, new_seed_creditable ? "" : "non-"); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 243 | fd = open(non_creditable_seed, O_WRONLY | O_CREAT | O_TRUNC, 0400); |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 244 | if (fd < 0 || full_write(fd, new_seed, new_seed_len) != (ssize_t)new_seed_len || fsync(fd) < 0) { |
Jason A. Donenfeld | 57fea02 | 2022-04-20 15:40:40 +0200 | [diff] [blame^] | 245 | bb_perror_msg("unable to%s seed", " write"); |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 246 | program_ret |= 1 << 4; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 247 | goto out; |
| 248 | } |
| 249 | if (new_seed_creditable && rename(non_creditable_seed, creditable_seed) < 0) { |
Jason A. Donenfeld | 4538578 | 2022-04-20 15:22:55 +0200 | [diff] [blame] | 250 | bb_simple_perror_msg("unable to make new seed creditable"); |
Jason A. Donenfeld | 398bb38 | 2022-04-20 15:34:20 +0200 | [diff] [blame] | 251 | program_ret |= 1 << 5; |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 252 | } |
| 253 | out: |
Jason A. Donenfeld | 31ec481 | 2022-04-20 15:27:29 +0200 | [diff] [blame] | 254 | if (ENABLE_FEATURE_CLEAN_UP && fd >= 0) |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 255 | close(fd); |
Jason A. Donenfeld | 3c60711 | 2022-04-20 15:31:01 +0200 | [diff] [blame] | 256 | if (ENABLE_FEATURE_CLEAN_UP && dfd >= 0) |
| 257 | close(dfd); |
Jason A. Donenfeld | 4b407ba | 2022-04-04 18:21:51 +0200 | [diff] [blame] | 258 | return program_ret; |
| 259 | } |