On Mon, Jan 20, 2020 at 11:57:04PM +0100, Andreas Pretzsch wrote: > For devices with no or defective HW RNG, it takes quite long until > the kernel random device is seeded, up to several 10 seconds. > See kernel "random: crng init done" message for this. > > As a consequence, anything using /dev/random will block accordingly. > This is even true for "ssh-keygen -l" invocations, which should just > show the fingerprint of a pubkey. Which can be used e.g. to check for > valid keys to be present. > > One way to expedite this is to run haveged, of course at the cost of > reduced quality of the random numbers. > But this start has to happen rather early in the boot process. > > By default (based upon this (old) haveged package), haveged is started > late as user service in multi-user.target. > > So move the start of haveged from multi-user.target to sysinit.target. > Also add a service dependency on after systemd-random-seed.service > (responsible to seed from a stored random pool, if enabled) and > systemd-tmpfiles-setup-dev.service (responsible to setup the dev files). > > Comparable is done within Fedora and SuSE. > > Signed-off-by: Andreas Pretzsch <[email protected]> > --- > projectroot/usr/lib/systemd/system/haveged.service | 3 ++- > rules/haveged.make | 4 ++-- > 2 files changed, 4 insertions(+), 3 deletions(-) > > diff --git a/projectroot/usr/lib/systemd/system/haveged.service > b/projectroot/usr/lib/systemd/system/haveged.service > index 81070ca8b..5fab8c665 100644 > --- a/projectroot/usr/lib/systemd/system/haveged.service > +++ b/projectroot/usr/lib/systemd/system/haveged.service > @@ -1,6 +1,7 @@ > [Unit] > Description=Entropy Daemon based on the HAVEGE algorithm > Documentation=man:haveged(8) http://www.issihosts.com/haveged/ > +After=systemd-random-seed.service systemd-tmpfiles-setup-dev.service
Maybe add DefaultDependencies=no as well? Michael > > [Service] > Type=simple > @@ -8,4 +9,4 @@ ExecStart=/usr/sbin/haveged -w 1024 -v 1 --Foreground > SuccessExitStatus=143 > > [Install] > -WantedBy=multi-user.target > +WantedBy=sysinit.target > diff --git a/rules/haveged.make b/rules/haveged.make > index 80d1910f3..0c880b191 100644 > --- a/rules/haveged.make > +++ b/rules/haveged.make > @@ -73,10 +73,10 @@ endif > endif > > ifdef PTXCONF_HAVEGED_SYSTEMD_UNIT > - @$(call install_copy, haveged, 0, 0, 0644, -, \ > + @$(call install_alternative, haveged, 0, 0, 0644, \ > /usr/lib/systemd/system/haveged.service) > @$(call install_link, haveged, ../haveged.service, \ > - /usr/lib/systemd/system/multi-user.target.wants/haveged.service) > + /usr/lib/systemd/system/sysinit.target.wants/haveged.service) > endif > > @$(call install_finish, haveged) > -- > 2.19.1 > > > _______________________________________________ > ptxdist mailing list > [email protected] > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | _______________________________________________ ptxdist mailing list [email protected]
