Skip to contentSkip to conversation

system/permissions: /etc/random-seed must be mode 600

PATCH New Gustavo Zacarias 3 participants 5 messages Nov 20, 2014 – Nov 25, 2014

lore
Share & tools
lore

Gustavo Zacarias

author
#0 lore raw

PATCH 1/1 system/permissions: /etc/random-seed must be mode 600

Otherwise it's a big security risk.

Signed-off-by Gustavo Zacarias <[email protected]>
---
 system/device_table.txt | 1 +
 1 file changed, 1 insertion(+)
system/device_table.txt +1 -0
index e15412d..8e7dbd2 100644
@@ -11,6 +11,7 @@
 /etc					d	755	0	0	-	-	-	-	-
 /root					d	700	0	0	-	-	-	-	-
 /var/www				d	755	33	33	-	-	-	-	-
+/etc/random-seed			f	600	0	0	-	-	-	-	-
 /etc/shadow				f	600	0	0	-	-	-	-	-
 /etc/passwd				f	644	0	0	-	-	-	-	-
 /etc/network/if-up.d			d	755	0	0	-	-	-	-	-
Signature · 1 line
2.0.4
#1 lore raw

PATCH 1/1 system/permissions: /etc/random-seed must be mode 600

Quoted 12 lines · On Thursday 20 November 2014 18:08:14 Gustavo Zacarias wrote:

Otherwise it's a big security risk.

Signed-off-by Gustavo Zacarias <[email protected]>
---
 system/device_table.txt | 1 +
 1 file changed, 1 insertion(+)
system/device_table.txt +0 -0
index e15412d..8e7dbd2 100644

system/device_table.txt line 14

Quoted 4 lines
system/device_table.txt +1 -0
@@ -11,6 +11,7 @@
 /etc					d	755	0	0	-	-	-	-	-
 /root					d	700	0	0	-	-	-	-	-
 /var/www				d	755	33	33	-	-	-	-	-
+/etc/random-seed			f	600	0	0	-	-	-	-	-

Just curiosity, does it make sense to provide a random seed? I mean, it is not very random, is it?

Signature · 3 lines
J?r?me Pouiller, Sysmic
Embedded Linux specialist
http://www.sysmic.fr
#2 lore raw

PATCH 1/1 system/permissions: /etc/random-seed must be mode 600

Quoted 10 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"J?r?me" == J?r?me Pouiller <[email protected]> writes:

Quoted 7 lines · On Thursday 20 November 2014 18:08:14 Gustavo Zacarias wrote:

Otherwise it's a big security risk.

Signed-off-by Gustavo Zacarias <[email protected]>

---
system/device_table.txt | 1 +

1 file changed, 1 insertion(+)
Quoted 12 lines
Quoted 9 lines
system/device_table.txt +0 -0
index e15412d..8e7dbd2 100644
@@ -11,6 +11,7 @@

/etc d 755 0 0 - - - - -
/root d 700 0 0 - - - - -
/var/www d 755 33 33 - - - - -
+/etc/random-seed f 600 0 0 - - - - -

Just curiosity, does it make sense to provide a random seed? I mean, it is not very random, is it?

Indeed. My thoughts exactly. Gustavoz?

Signature · 1 line
Bye, Peter Korsgaard
author
#3 lore raw

PATCH 1/1 system/permissions: /etc/random-seed must be mode 600

In reply to Jérôme Pouiller
Quoted 2 lines · J?r?me Pouiller

Just curiosity, does it make sense to provide a random seed? I mean, it is not very random, is it?

I have another patch that creates random-seed at build-time that i'm testing.
That's not too good either since it's fixed "per firmware image" so to speak, but at least it's better than an easily downloadable fixed seed from many mirrors :)
The problem with mode 744 (currently) is that anyone can read the seed, which as we know is fixed for now, but they can also read the evolved seed too _IF_ the box/device shutdowns properly.
I guess it's time to write some best practices documentation, in this aspect we can't cover for all the varying possibilities i'm afraid. Ideally a separate partition/eeprom would contain the seed so as to make it unique to each device and firmware-independant.
And no, using the device MAC address/serial number for this isn't that good :)
Regards.