shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-10-30 14:55:37 +03:00
Code
059cc610b7
systemd/units/systemd-random-seed.service.in

32 lines
1.1 KiB
SYSTEMD
Raw Normal View History

license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 07:23:58 +03:00
# SPDX-License-Identifier: LGPL-2.1-or-later
Add SPDX license headers to unit files
2017-11-18 19:35:03 +03:00
#
random-seed: add little tool for saving/loading random seed on shutdown/boot, but don't enable it by default
2010-08-14 21:17:37 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 02:20:58 +04:00
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
random-seed: add little tool for saving/loading random seed on shutdown/boot, but don't enable it by default
2010-08-14 21:17:37 +04:00
# (at your option) any later version.
[Unit]
units: rework systemd-random-seed-{load,save}.service to be a single service That way ordering it with MountsRequiredFor= works properly, as this no longer results in mount units start requests to be added to the shutdown transaction that conflict with stop requests for the same unit.
2013-05-16 00:38:51 +04:00
Description=Load/Save Random Seed
Fix obsolete references to systemd-random-seed-load.service This service was merged with systemd-random-seed-save.service in c35b956d34bbb8bb208e49e45de2c103ca11911c.
2013-09-22 22:38:24 +04:00
Documentation=man:systemd-random-seed.service(8) man:random(4)
random-seed: add little tool for saving/loading random seed on shutdown/boot, but don't enable it by default
2010-08-14 21:17:37 +04:00
DefaultDependencies=no
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
RequiresMountsFor={{RANDOM_SEED}}
units: rework systemd-random-seed-{load,save}.service to be a single service That way ordering it with MountsRequiredFor= works properly, as this no longer results in mount units start requests to be added to the shutdown transaction that conflict with stop requests for the same unit.
2013-05-16 00:38:51 +04:00
Conflicts=shutdown.target
readahead: wipe out readahead
2014-08-26 23:17:22 +04:00
After=systemd-remount-fs.service
units: order systemd-random-seed.service before first-boot-complete.target Ensure that systemd-random-seed.service has completed before marking a first boot as completed to guarantee that a saved seed will only be used after it has been initialized at least once.
2020-09-06 22:43:57 +03:00
Before=first-boot-complete.target shutdown.target
Wants=first-boot-complete.target
units: do not start load-random-seed in containers (#3941) Random numbers are provided by the host kernel, we don't need to do anything. https://bugzilla.redhat.com/show_bug.cgi?id=1329124
2016-08-13 18:15:19 +03:00
ConditionVirtualization=!container
random-seed: add little tool for saving/loading random seed on shutdown/boot, but don't enable it by default
2010-08-14 21:17:37 +04:00
[Service]
Type=oneshot
units: rework systemd-random-seed-{load,save}.service to be a single service That way ordering it with MountsRequiredFor= works properly, as this no longer results in mount units start requests to be added to the shutdown transaction that conflict with stop requests for the same unit.
2013-05-16 00:38:51 +04:00
RemainAfterExit=yes
meson: use jinja2 for unit templates We don't need two (and half) templating systems anymore, yay! I'm keeping the changes minimal, to make the diff manageable. Some enhancements due to a better templating system might be possible in the future. For handling of '## ' — see the next commit.
2021-05-16 12:55:36 +03:00
ExecStart={{ROOTLIBEXECDIR}}/systemd-random-seed load
ExecStop={{ROOTLIBEXECDIR}}/systemd-random-seed save
random-seed: rework systemd-random-seed.service substantially This makes two major changes to the way systemd-random-seed operates: 1. We now optionally credit entropy if this is configured (via an env var). Previously we never would do that, with this change we still don't by default, but it's possible to enable this if people acknowledge that they shouldn't replicate an image with a contained random seed to multiple systems. Note that in this patch crediting entropy is a boolean thing (unlike in previous attempts such as #1062), where only a relative amount of bits was credited. The simpler scheme implemented here should be OK though as the random seeds saved to disk are now written only with data from the kernel's entropy pool retrieved after the pool is fully initialized. Specifically: 2. This makes systemd-random-seed.service a synchronization point for kernel entropy pool initialization. It was already used like this, for example by systemd-cryptsetup-generator's /dev/urandom passphrase handling, with this change it explicitly operates like that (at least systems which provide getrandom(), where we can support this). This means services that rely on an initialized random pool should now place After=systemd-random-seed.service and everything should be fine. Note that with this change sysinit.target (and thus early boot) is NOT systematically delayed until the entropy pool is initialized, i.e. regular services need to add explicit ordering deps on this service if they require an initialized random pool. Fixes: #4271 Replaces: #10621 #4513
2019-07-22 14:51:30 +03:00
# This service waits until the kernel's entropy pool is initialized, and may be
# used as ordering barrier for service that require an initialized entropy
# pool. Since initialization can take a while on entropy-starved systems, let's
tree-wide: s/time-out/timeout/g See 3f9a0a522f2029e9295ea5e9984259022be88413 for justification.
2020-05-22 10:39:36 +03:00
# increase the timeout substantially here.
random-seed: rework systemd-random-seed.service substantially This makes two major changes to the way systemd-random-seed operates: 1. We now optionally credit entropy if this is configured (via an env var). Previously we never would do that, with this change we still don't by default, but it's possible to enable this if people acknowledge that they shouldn't replicate an image with a contained random seed to multiple systems. Note that in this patch crediting entropy is a boolean thing (unlike in previous attempts such as #1062), where only a relative amount of bits was credited. The simpler scheme implemented here should be OK though as the random seeds saved to disk are now written only with data from the kernel's entropy pool retrieved after the pool is fully initialized. Specifically: 2. This makes systemd-random-seed.service a synchronization point for kernel entropy pool initialization. It was already used like this, for example by systemd-cryptsetup-generator's /dev/urandom passphrase handling, with this change it explicitly operates like that (at least systems which provide getrandom(), where we can support this). This means services that rely on an initialized random pool should now place After=systemd-random-seed.service and everything should be fine. Note that with this change sysinit.target (and thus early boot) is NOT systematically delayed until the entropy pool is initialized, i.e. regular services need to add explicit ordering deps on this service if they require an initialized random pool. Fixes: #4271 Replaces: #10621 #4513
2019-07-22 14:51:30 +03:00
TimeoutSec=10min
Copy Permalink