shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-12-23 21:35:11 +03:00
Code
4704176795
systemd/units/systemd-random-seed.service.in

36 lines
1.1 KiB
SYSTEMD
Raw Normal View History

license: LGPL-2.1+ -> LGPL-2.1-or-later
2020-11-09 07:23:58 +03:00
# SPDX-License-Identifier: LGPL-2.1-or-later
Add SPDX license headers to unit files
2017-11-18 19:35:03 +03:00
#
random-seed: add little tool for saving/loading random seed on shutdown/boot, but don't enable it by default
2010-08-14 21:17:37 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
relicense to LGPLv2.1 (with exceptions) We finally got the OK from all contributors with non-trivial commits to relicense systemd from GPL2+ to LGPL2.1+. Some udev bits continue to be GPL2+ for now, but we are looking into relicensing them too, to allow free copy/paste of all code within systemd. The bits that used to be MIT continue to be MIT. The big benefit of the relicensing is that closed source code may now link against libsystemd-login.so and friends.
2012-04-12 02:20:58 +04:00
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
random-seed: add little tool for saving/loading random seed on shutdown/boot, but don't enable it by default
2010-08-14 21:17:37 +04:00
# (at your option) any later version.
[Unit]
units: rename/rework systemd-boot-system-token.service → systemd-boot-random-seed.service This renames systemd-boot-system-token.service to systemd-boot-random-seed.service and conditions it less strictly. Previously, the job of the service was to write a "system token" EFI variable if it was missing. It called "bootctl --graceful random-seed" for that. With this change we condition it more liberally: instead of calling it only when the "system token" EFI variable isn't set, we call it whenever a boot loader interface compatible boot loader is used. This means, previously it was invoked on the first boot only: now it is invoked at every boot. This doesn#t change the command that is invoked. That's because previously already the "bootctl --graceful random-seed" did two things: set the system token if not set yet *and* refresh the random seed in the ESP. Previousy we put the focus on the former, now we shift the focus to the latter. With this simple change we can replace the logic f913c784ad4c93894fd6cb2590738113dff5a694 added, but from a service that can run much later and doesn't keep the ESP pinned.
2022-12-20 19:16:47 +03:00
Description=Load/Save OS Random Seed
Fix obsolete references to systemd-random-seed-load.service This service was merged with systemd-random-seed-save.service in c35b956d34bbb8bb208e49e45de2c103ca11911c.
2013-09-22 22:38:24 +04:00
Documentation=man:systemd-random-seed.service(8) man:random(4)
units: rename/rework systemd-boot-system-token.service → systemd-boot-random-seed.service This renames systemd-boot-system-token.service to systemd-boot-random-seed.service and conditions it less strictly. Previously, the job of the service was to write a "system token" EFI variable if it was missing. It called "bootctl --graceful random-seed" for that. With this change we condition it more liberally: instead of calling it only when the "system token" EFI variable isn't set, we call it whenever a boot loader interface compatible boot loader is used. This means, previously it was invoked on the first boot only: now it is invoked at every boot. This doesn#t change the command that is invoked. That's because previously already the "bootctl --graceful random-seed" did two things: set the system token if not set yet *and* refresh the random seed in the ESP. Previousy we put the focus on the former, now we shift the focus to the latter. With this simple change we can replace the logic f913c784ad4c93894fd6cb2590738113dff5a694 added, but from a service that can run much later and doesn't keep the ESP pinned.
2022-12-20 19:16:47 +03:00
units: do more reordering of ordering config No functional change, just a cleanup to make the subsequent changes easier to see. This is a continuation of 9810e419425263bde86787bc21251f1ad3c35628 > The block is reordered and split to have: > 1. description + documentation > 2. (optionally) conditions > 3. all the dependencies The dependencies for shutdown.target are listed separately because they are the other deps are for startup, and shutdown.target only matter much later.
2022-09-15 16:54:18 +03:00
ConditionVirtualization=!container
ConditionPathExists=!/etc/initrd-release
random-seed: add little tool for saving/loading random seed on shutdown/boot, but don't enable it by default
2010-08-14 21:17:37 +04:00
DefaultDependencies=no
readahead: wipe out readahead
2014-08-26 23:17:22 +04:00
After=systemd-remount-fs.service
units: do more reordering of ordering config No functional change, just a cleanup to make the subsequent changes easier to see. This is a continuation of 9810e419425263bde86787bc21251f1ad3c35628 > The block is reordered and split to have: > 1. description + documentation > 2. (optionally) conditions > 3. all the dependencies The dependencies for shutdown.target are listed separately because they are the other deps are for startup, and shutdown.target only matter much later.
2022-09-15 16:54:18 +03:00
Before=first-boot-complete.target
RequiresMountsFor={{RANDOM_SEED}}
units: order systemd-random-seed.service before first-boot-complete.target Ensure that systemd-random-seed.service has completed before marking a first boot as completed to guarantee that a saved seed will only be used after it has been initialized at least once.
2020-09-06 22:43:57 +03:00
Wants=first-boot-complete.target
units: do more reordering of ordering config No functional change, just a cleanup to make the subsequent changes easier to see. This is a continuation of 9810e419425263bde86787bc21251f1ad3c35628 > The block is reordered and split to have: > 1. description + documentation > 2. (optionally) conditions > 3. all the dependencies The dependencies for shutdown.target are listed separately because they are the other deps are for startup, and shutdown.target only matter much later.
2022-09-15 16:54:18 +03:00
Conflicts=shutdown.target
Before=shutdown.target
random-seed: add little tool for saving/loading random seed on shutdown/boot, but don't enable it by default
2010-08-14 21:17:37 +04:00
[Service]
Type=oneshot
units: rework systemd-random-seed-{load,save}.service to be a single service That way ordering it with MountsRequiredFor= works properly, as this no longer results in mount units start requests to be added to the shutdown transaction that conflict with stop requests for the same unit.
2013-05-16 00:38:51 +04:00
RemainAfterExit=yes
Drop split-usr and unmerged-usr support As previously announced, execute order 66: https://lists.freedesktop.org/archives/systemd-devel/2022-September/048352.html The meson options split-usr, rootlibdir and rootprefix become no-ops that print a warning if they are set to anything other than the default values. We can remove them in a future release.
2023-06-12 04:15:19 +03:00
ExecStart={{LIBEXECDIR}}/systemd-random-seed load
ExecStop={{LIBEXECDIR}}/systemd-random-seed save
random-seed: rework systemd-random-seed.service substantially This makes two major changes to the way systemd-random-seed operates: 1. We now optionally credit entropy if this is configured (via an env var). Previously we never would do that, with this change we still don't by default, but it's possible to enable this if people acknowledge that they shouldn't replicate an image with a contained random seed to multiple systems. Note that in this patch crediting entropy is a boolean thing (unlike in previous attempts such as #1062), where only a relative amount of bits was credited. The simpler scheme implemented here should be OK though as the random seeds saved to disk are now written only with data from the kernel's entropy pool retrieved after the pool is fully initialized. Specifically: 2. This makes systemd-random-seed.service a synchronization point for kernel entropy pool initialization. It was already used like this, for example by systemd-cryptsetup-generator's /dev/urandom passphrase handling, with this change it explicitly operates like that (at least systems which provide getrandom(), where we can support this). This means services that rely on an initialized random pool should now place After=systemd-random-seed.service and everything should be fine. Note that with this change sysinit.target (and thus early boot) is NOT systematically delayed until the entropy pool is initialized, i.e. regular services need to add explicit ordering deps on this service if they require an initialized random pool. Fixes: #4271 Replaces: #10621 #4513
2019-07-22 14:51:30 +03:00
# This service waits until the kernel's entropy pool is initialized, and may be
# used as ordering barrier for service that require an initialized entropy
# pool. Since initialization can take a while on entropy-starved systems, let's
tree-wide: s/time-out/timeout/g See 3f9a0a522f2029e9295ea5e9984259022be88413 for justification.
2020-05-22 10:39:36 +03:00
# increase the timeout substantially here.
random-seed: rework systemd-random-seed.service substantially This makes two major changes to the way systemd-random-seed operates: 1. We now optionally credit entropy if this is configured (via an env var). Previously we never would do that, with this change we still don't by default, but it's possible to enable this if people acknowledge that they shouldn't replicate an image with a contained random seed to multiple systems. Note that in this patch crediting entropy is a boolean thing (unlike in previous attempts such as #1062), where only a relative amount of bits was credited. The simpler scheme implemented here should be OK though as the random seeds saved to disk are now written only with data from the kernel's entropy pool retrieved after the pool is fully initialized. Specifically: 2. This makes systemd-random-seed.service a synchronization point for kernel entropy pool initialization. It was already used like this, for example by systemd-cryptsetup-generator's /dev/urandom passphrase handling, with this change it explicitly operates like that (at least systems which provide getrandom(), where we can support this). This means services that rely on an initialized random pool should now place After=systemd-random-seed.service and everything should be fine. Note that with this change sysinit.target (and thus early boot) is NOT systematically delayed until the entropy pool is initialized, i.e. regular services need to add explicit ordering deps on this service if they require an initialized random pool. Fixes: #4271 Replaces: #10621 #4513
2019-07-22 14:51:30 +03:00
TimeoutSec=10min
Copy Permalink