15 Commits

Author	SHA1	Message	Date
nicoo	e64d3f60fb	nixos/modules/security/rngd: Disable by default ... `rngd` seems to be the root cause for slow boot issues, and its functionality is redundant since kernel v3.17 (2014), which introduced a `krngd` task (in kernel space) that takes care of pulling in data from hardware RNGs: > commit be4000bc4644d027c519b6361f5ae3bbfc52c347 > Author: Torsten Duwe <duwe@lst.de> > Date: Sat Jun 14 23:46:03 2014 -0400 > > hwrng: create filler thread > > This can be viewed as the in-kernel equivalent of hwrngd; > like FUSE it is a good thing to have a mechanism in user land, > but for some reasons (simplicity, secrecy, integrity, speed) > it may be better to have it in kernel space. > > This patch creates a thread once a hwrng registers, and uses > the previously established add_hwgenerator_randomness() to feed > its data to the input pool as long as needed. A derating factor > is used to bias the entropy estimation and to disable this > mechanism entirely when set to zero. Closes: #96067	2020-09-09 21:51:25 -04:00
worldofpeace	fa76150235	nixos/rngd: fix clean shutdown ... It seems disabling DefaultDependencies removes these implicit dependencies [0] that we needed for shutdown to happen cleanly. Fixes #80871 [0]: https://www.freedesktop.org/software/systemd/man/systemd.service.html#Default%20Dependencies	2020-02-23 18:53:52 -05:00
Daniel Frank	d14ba1e1ad	security.rngd: start rngd during early boot to reduce entropy starvation due to encrypted swap and remove PrivateTmp to avoid a circular dependency	2020-02-08 12:29:13 +01:00
Will Dietz	e5d049e469	rngd: harden service config, from arch	2019-05-07 22:53:09 -05:00
Will Dietz	b809071ffb	rngd: add option to run w/debug flag ... Added while testing if adding hardening directives to the service blocked access to various sources, might be useful in the future.	2019-05-06 23:44:38 -05:00
Gabriel Ebner	20078fd5b2	nixos/rngd: do not pass --version flag	2018-11-05 10:41:38 +01:00
Renaud	deacd0bd73	nixos/rngd: fix exec flags and udev rules ... TPM1.2 support has been dropped in rng-tools v6.5 see caef8cce97 rngd won't access /dev/tpm0 anymore and the "--no-tpm=1" option is now unrecognised	2018-10-28 17:31:35 +01:00
Renaud	b2f6aa0069	nixos/rngd: use new name pkgs.rng-tools ... Instead of pkgs.rng_tools which is now an alias	2018-10-24 13:46:08 +02:00
Scott R. Parish	a560223119	rngd: update modalias to match cpu type ... It looks like the cpu type part of modalias might have changed, my systems (4.4.20 and 4.7.2) show something like the following: ``` cpu:type:x86,ven0000fam0006mod003F:feature:,0000,0001,0002,0003,0004,0005,0006,0007,0008,0009,000B,000C,000D,000E,000F,0010,0011,0013,0017,0018,0019,001A,001C,002B,0034,003B,003D,0068,006F,0070,0072,0074,0075,0076,007D,0080,0081,0089,008C,008D,0091,0093,0094,0095,0096,0097,0098,0099,009A,009B,009C,009D,009E,009F,00C0,00C5,0120,0123,0125,0127,0128,0129,012A,0140 ``` Update the rngd modalias rule to match this so udev properly has systemd start rngd.	2016-09-17 18:36:57 -07:00
Nikolay Amiantov	dbc0395b2b	nixos/rngd: some fixes	2015-01-06 17:27:07 +03:00
Alexander Kjeldaas	baf4faeddc	Only disable TPM access by rngd when tcsd is enabled.	2014-04-22 14:05:09 +02:00
Alexander Kjeldaas	64311899db	Don't let rngd read /dev/tpm0. ... Only one process can interact with the TPM module and that process should be tcsd. The tpm_rng kernel module should instead be loaded and /dev/hwrnd be used to read the TPM random generator. Also, log which random generator devices are used by rngd on startup.	2014-04-22 14:05:09 +02:00
Eelco Dolstra	29027fd1e1	Rewrite ‘with pkgs.lib’ -> ‘with lib’ ... Using pkgs.lib on the spine of module evaluation is problematic because the pkgs argument depends on the result of module evaluation. To prevent an infinite recursion, pkgs and some of the modules are evaluated twice, which is inefficient. Using ‘with lib’ prevents this problem.	2014-04-14 16:26:48 +02:00
Eelco Dolstra	408b8b5725	Add lots of missing option types	2013-10-30 18:47:43 +01:00
Eelco Dolstra	5c1f8cbc70	Move all of NixOS to nixos/ in preparation of the repository merge	2013-10-10 13:28:20 +02:00