head	1.1;
access;
symbols
	netbsd-11-0-RC6:1.1
	netbsd-11-0-RC5:1.1
	netbsd-11-0-RC4:1.1
	netbsd-11-0-RC3:1.1
	netbsd-11-0-RC2:1.1
	netbsd-11-0-RC1:1.1
	perseant-exfatfs-base-20250801:1.1
	netbsd-11:1.1.0.10
	netbsd-11-base:1.1
	netbsd-10-1-RELEASE:1.1
	perseant-exfatfs-base-20240630:1.1
	perseant-exfatfs:1.1.0.8
	perseant-exfatfs-base:1.1
	netbsd-10-0-RELEASE:1.1
	netbsd-10-0-RC6:1.1
	netbsd-10-0-RC5:1.1
	netbsd-10-0-RC4:1.1
	netbsd-10-0-RC3:1.1
	netbsd-10-0-RC2:1.1
	netbsd-10-0-RC1:1.1
	netbsd-10:1.1.0.6
	netbsd-10-base:1.1
	cjep_sun2x-base1:1.1
	cjep_sun2x:1.1.0.4
	cjep_sun2x-base:1.1
	cjep_staticlib_x-base1:1.1
	cjep_staticlib_x:1.1.0.2
	cjep_staticlib_x-base:1.1;
locks; strict;
comment	@# @;


1.1
date	2021.01.10.23.24.25;	author riastradh;	state Exp;
branches;
next	;
commitid	nvjdXwWVOKPFFeDC;


desc
@@


1.1
log
@Various entropy integration improvements.

- New /etc/security check for entropy in daily security report.

- New /etc/rc.d/entropy script runs (after random_seed and rndctl) to
  check for entropy at boot -- in rc.conf, you can:

  . set `entropy=check' to halt multiuser boot and enter single-user
    mode if not enough entropy

  . set `entropy=wait' to make multiuser boot wait until enough entropy

  Default is to always boot without waiting -- and rely on other
  channels like security report to alert the operator if there's a
  problem.

- New man page entropy(7) discussing the higher-level concepts and
  system integration with cross-references.

- New paragraph in afterboot(8) about entropy citing entropy(7) for
  more details.

This change addresses many of the issues discussed in security/55659.
This is a first draft; happy to take improvements to the man pages and
scripted messages to improve clarity.

I considered changing motd to include an entropy warning with a
reference to the entropy(7) man page, but it's a little trickier:
- Not sure it's appropriate for all users to see at login rather than
  users who have power to affect the entropy estimate (maybe it is,
  just haven't decided).
- We only have a mechanism for changing once at boot; the message would
  remain until next boot even if an operator adds enough entropy.
- The mechanism isn't really conducive to making a message appear
  conditionally from boot to boot.
@
text
@#!/bin/sh
#
# $NetBSD$
#

# PROVIDE: entropy
# REQUIRE: random_seed rndctl
# BEFORE: ike ipsec network

$_rc_subr_loaded . /etc/rc.subr

name="entropy"
start_cmd="entropy_start"
stop_cmd=":"

entropy_start()
{
	case ${entropy-} in
	'')	;;
	check)	echo -n "Checking for entropy..."
		# dd will print an error message `Resource temporarily
		# unavailable' to stderr, which is a little annoying,
		# but getting rid of it is also a little annoying.
		if dd if=/dev/random iflag=nonblock of=/dev/null bs=1 count=1 \
		    msgfmt=quiet; then
			echo "done"
		else
			echo "not enough entropy available, aborting boot."
			stop_boot
		fi
		;;
	wait)	echo -n "Waiting for entropy..."
		dd if=/dev/random of=/dev/null bs=1 count=1 msgfmt=quiet
		echo "done"
		;;
	esac
}

load_rc_config "$name"
run_rc_command "$1"
@