rng-tools fixes and enhancements

See patches for details.

Jan Kiszka (3):
rng-tools: Start as early as possible
rng-tools: Don't use /dev/urandom as rngd default source
rng-tools: Add support for Atheros 9170 hwrng

 meta/recipes-support/rng-tools/rng-tools/default | 11 +++++++++--
 meta/recipes-support/rng-tools/rng-tools/init    |  3 +++
 meta/recipes-support/rng-tools/rng-tools_5.bb    |  2 +-
 3 files changed, 13 insertions(+), 3 deletions(-)

2.12.3

From: Jan Kiszka <[email protected]>

This helps systems with little architectural entropy to initialize the random pool earlier. We just need to wait for udev so that drivers have been probed already.

---
 meta/recipes-support/rng-tools/rng-tools_5.bb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index de6e5f9a76..ba5076204c 100644
@@ -41,4 +41,4 @@ do_install_append() {
 }
 
 INITSCRIPT_NAME = "rng-tools"
-INITSCRIPT_PARAMS = "start 30 2 3 4 5 . stop 30 0 6 1 ."
+INITSCRIPT_PARAMS = "start 05 S 0 6 . stop 30 0 6 1 ."

2.12.3

From: Jan Kiszka <[email protected]>

Big no-no when you want to have more than a toy device, so let's not make this a default. See also https://lwn.net/Articles/525459.

---
 meta/recipes-support/rng-tools/rng-tools/default | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

index 7aede9be03..b968f2b789 100644
@@ -1,3 +1,6 @@
 # Specify rng device
-#RNG_DEVICE=/dev/hwrng
-RNG_DEVICE=/dev/urandom
+RNG_DEVICE=/dev/hwrng
+
+# Don't use urandom as source unless you fully understood what that does to
+# your system security!
+#RNG_DEVICE=/dev/urandom

2.12.3

From: Jan Kiszka <[email protected]>

Useful only on devices with no other sources: USB WLAN sticks based on the Atheros 9170 (carl9170 kernel driver) provide a hardware random generator. However, the interface needs to be up in order to is the generator. That's not the case until ifup ran, but wpa_supplicant will block this until the random pool is initialized.

---
 meta/recipes-support/rng-tools/rng-tools/default | 4 ++++
 meta/recipes-support/rng-tools/rng-tools/init    | 3 +++
 2 files changed, 7 insertions(+)

index b968f2b789..85c5833a32 100644
@@ -4,3 +4,7 @@ RNG_DEVICE=/dev/hwrng
 # Don't use urandom as source unless you fully understood what that does to
 # your system security!
 #RNG_DEVICE=/dev/urandom
+
+# Specify wlan interface to enable if rngd should use Atheros 9170 as source.
+# See kernel config help for the security limitations of this.
+#CARL9170_HWRNG_INTERFACE="wlan0"

index 7cf78393a4..30cfc0f3d5 100644
@@ -20,6 +20,9 @@ fi
 case "$1" in
   start)
     echo -n "Starting random number generator daemon"
+    if [ -n "$CARL9170_HWRNG_INTERFACE" ]; then
+        ip link set $CARL9170_HWRNG_INTERFACE up
+    fi
     start-stop-daemon -S -q -x $rngd $EXTRA_ARGS
     echo "."
     ;;

2.12.3