public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/modules/security/rngd: Disable by default

Browse Source 
`rngd` seems to be the root cause for slow boot issues, and its functionality is
redundant since kernel v3.17 (2014), which introduced a `krngd` task (in kernel
space) that takes care of pulling in data from hardware RNGs:

> commit be4000bc4644d027c519b6361f5ae3bbfc52c347
> Author: Torsten Duwe <duwe@lst.de>
> Date:   Sat Jun 14 23:46:03 2014 -0400
>
>     hwrng: create filler thread
>
>     This can be viewed as the in-kernel equivalent of hwrngd;
>     like FUSE it is a good thing to have a mechanism in user land,
>     but for some reasons (simplicity, secrecy, integrity, speed)
>     it may be better to have it in kernel space.
>
>     This patch creates a thread once a hwrng registers, and uses
>     the previously established add_hwgenerator_randomness() to feed
>     its data to the input pool as long as needed. A derating factor
>     is used to bias the entropy estimation and to disable this
>     mechanism entirely when set to zero.

Closes: #96067
This commit is contained in:
nicoo 2020-08-23 15:12:13 +02:00 committed by worldofpeace
parent f6a3e70c50
commit e64d3f60fb
1 changed files with 3 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
nixos/modules/security/rngd.nix
View File

@ -10,11 +10,10 @@ in
security.rngd = { security.rngd = {
enable = mkOption { enable = mkOption {
type = types.bool; type = types.bool;
default = true; default = false;
description = '' description = ''
Whether to enable the rng daemon, which adds entropy from Whether to enable the rng daemon. Devices that the kernel recognises
hardware sources of randomness to the kernel entropy pool when as entropy sources are handled automatically by krngd.
available.
''; '';
}; };
debug = mkOption { debug = mkOption {
@ -26,12 +25,6 @@ in
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
services.udev.extraRules = ''
KERNEL=="random", TAG+="systemd"
SUBSYSTEM=="cpu", ENV{MODALIAS}=="cpu:type:x86,*feature:*009E*", TAG+="systemd", ENV{SYSTEMD_WANTS}+="rngd.service"
KERNEL=="hw_random", TAG+="systemd", ENV{SYSTEMD_WANTS}+="rngd.service"
'';
systemd.services.rngd = { systemd.services.rngd = {
bindsTo = [ "dev-random.device" ]; bindsTo = [ "dev-random.device" ];