systemd-stable/units/systemd-random-seed.service.in

#  SPDX-License-Identifier: LGPL-2.1-or-later
#
#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.

[Unit]
Description=Load/Save Random Seed
Documentation=man:systemd-random-seed.service(8) man:random(4)
DefaultDependencies=no
RequiresMountsFor=@RANDOM_SEED@
Conflicts=shutdown.target
After=systemd-remount-fs.service
Before=first-boot-complete.target shutdown.target
Wants=first-boot-complete.target
ConditionVirtualization=!container

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=@rootlibexecdir@/systemd-random-seed load
ExecStop=@rootlibexecdir@/systemd-random-seed save

# This service waits until the kernel's entropy pool is initialized, and may be
# used as ordering barrier for service that require an initialized entropy
# pool. Since initialization can take a while on entropy-starved systems, let's
# increase the timeout substantially here.
TimeoutSec=10min
license: LGPL-2.1+ -> LGPL-2.1-or-later 2020-11-09 07:23:58 +03:00			`# SPDX-License-Identifier: LGPL-2.1-or-later`
Add SPDX license headers to unit files 2017-11-18 19:35:03 +03:00			`#`
random-seed: add little tool for saving/loading random seed on shutdown/boot, but don't enable it by default 2010-08-14 21:17:37 +04:00			`# This file is part of systemd.`
			`#`
			`# systemd is free software; you can redistribute it and/or modify it`
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends. 2012-04-12 02:20:58 +04:00			`# under the terms of the GNU Lesser General Public License as published by`
			`# the Free Software Foundation; either version 2.1 of the License, or`
random-seed: add little tool for saving/loading random seed on shutdown/boot, but don't enable it by default 2010-08-14 21:17:37 +04:00			`# (at your option) any later version.`

			`[Unit]`
units: rework systemd-random-seed-{load,save}.service to be a single service That way ordering it with MountsRequiredFor= works properly, as this no longer results in mount units start requests to be added to the shutdown transaction that conflict with stop requests for the same unit. 2013-05-16 00:38:51 +04:00			`Description=Load/Save Random Seed`
Fix obsolete references to systemd-random-seed-load.service This service was merged with systemd-random-seed-save.service in c35b956d34bbb8bb208e49e45de2c103ca11911c. 2013-09-22 22:38:24 +04:00			`Documentation=man:systemd-random-seed.service(8) man:random(4)`
random-seed: add little tool for saving/loading random seed on shutdown/boot, but don't enable it by default 2010-08-14 21:17:37 +04:00			`DefaultDependencies=no`
unit: add new dependency type RequiresMountsFor= RequiresMountsFor= is a shortcut for adding requires and after dependencies to all mount units neeed for the specified paths. This solves a couple of issues regarding dep loop cycles for encrypted swap. 2012-04-29 16:26:07 +04:00			`RequiresMountsFor=@RANDOM_SEED@`
units: rework systemd-random-seed-{load,save}.service to be a single service That way ordering it with MountsRequiredFor= works properly, as this no longer results in mount units start requests to be added to the shutdown transaction that conflict with stop requests for the same unit. 2013-05-16 00:38:51 +04:00			`Conflicts=shutdown.target`
readahead: wipe out readahead 2014-08-26 23:17:22 +04:00			`After=systemd-remount-fs.service`
units: order systemd-random-seed.service before first-boot-complete.target Ensure that systemd-random-seed.service has completed before marking a first boot as completed to guarantee that a saved seed will only be used after it has been initialized at least once. 2020-09-06 22:43:57 +03:00			`Before=first-boot-complete.target shutdown.target`
			`Wants=first-boot-complete.target`
units: do not start load-random-seed in containers (#3941) Random numbers are provided by the host kernel, we don't need to do anything. https://bugzilla.redhat.com/show_bug.cgi?id=1329124 2016-08-13 18:15:19 +03:00			`ConditionVirtualization=!container`
random-seed: add little tool for saving/loading random seed on shutdown/boot, but don't enable it by default 2010-08-14 21:17:37 +04:00
			`[Service]`
			`Type=oneshot`
units: rework systemd-random-seed-{load,save}.service to be a single service That way ordering it with MountsRequiredFor= works properly, as this no longer results in mount units start requests to be added to the shutdown transaction that conflict with stop requests for the same unit. 2013-05-16 00:38:51 +04:00			`RemainAfterExit=yes`
auto-getty: rework auto console getty logic to work in conjunction with single user mode 2010-08-17 05:29:46 +04:00			`ExecStart=@rootlibexecdir@/systemd-random-seed load`
units: rework systemd-random-seed-{load,save}.service to be a single service That way ordering it with MountsRequiredFor= works properly, as this no longer results in mount units start requests to be added to the shutdown transaction that conflict with stop requests for the same unit. 2013-05-16 00:38:51 +04:00			`ExecStop=@rootlibexecdir@/systemd-random-seed save`
random-seed: rework systemd-random-seed.service substantially This makes two major changes to the way systemd-random-seed operates: 1. We now optionally credit entropy if this is configured (via an env var). Previously we never would do that, with this change we still don't by default, but it's possible to enable this if people acknowledge that they shouldn't replicate an image with a contained random seed to multiple systems. Note that in this patch crediting entropy is a boolean thing (unlike in previous attempts such as #1062), where only a relative amount of bits was credited. The simpler scheme implemented here should be OK though as the random seeds saved to disk are now written only with data from the kernel's entropy pool retrieved after the pool is fully initialized. Specifically: 2. This makes systemd-random-seed.service a synchronization point for kernel entropy pool initialization. It was already used like this, for example by systemd-cryptsetup-generator's /dev/urandom passphrase handling, with this change it explicitly operates like that (at least systems which provide getrandom(), where we can support this). This means services that rely on an initialized random pool should now place After=systemd-random-seed.service and everything should be fine. Note that with this change sysinit.target (and thus early boot) is NOT systematically delayed until the entropy pool is initialized, i.e. regular services need to add explicit ordering deps on this service if they require an initialized random pool. Fixes: #4271 Replaces: #10621 #4513 2019-07-22 14:51:30 +03:00
			`# This service waits until the kernel's entropy pool is initialized, and may be`
			`# used as ordering barrier for service that require an initialized entropy`
			`# pool. Since initialization can take a while on entropy-starved systems, let's`
tree-wide: s/time-out/timeout/g See 3f9a0a522f2029e9295ea5e9984259022be88413 for justification. 2020-05-22 10:39:36 +03:00			`# increase the timeout substantially here.`
random-seed: rework systemd-random-seed.service substantially This makes two major changes to the way systemd-random-seed operates: 1. We now optionally credit entropy if this is configured (via an env var). Previously we never would do that, with this change we still don't by default, but it's possible to enable this if people acknowledge that they shouldn't replicate an image with a contained random seed to multiple systems. Note that in this patch crediting entropy is a boolean thing (unlike in previous attempts such as #1062), where only a relative amount of bits was credited. The simpler scheme implemented here should be OK though as the random seeds saved to disk are now written only with data from the kernel's entropy pool retrieved after the pool is fully initialized. Specifically: 2. This makes systemd-random-seed.service a synchronization point for kernel entropy pool initialization. It was already used like this, for example by systemd-cryptsetup-generator's /dev/urandom passphrase handling, with this change it explicitly operates like that (at least systems which provide getrandom(), where we can support this). This means services that rely on an initialized random pool should now place After=systemd-random-seed.service and everything should be fine. Note that with this change sysinit.target (and thus early boot) is NOT systematically delayed until the entropy pool is initialized, i.e. regular services need to add explicit ordering deps on this service if they require an initialized random pool. Fixes: #4271 Replaces: #10621 #4513 2019-07-22 14:51:30 +03:00			`TimeoutSec=10min`