From b410eb19130cf1eca158a672bba8f515e7627f11 Mon Sep 17 00:00:00 2001 From: Nick Kralevich Date: Tue, 17 Sep 2013 16:18:23 -0700 Subject: [PATCH] Initialize /dev/urandom earlier in boot. It's a security best practice to carry entropy across reboots. (see "man 4 random"). Currently, entropy saving and mixing occur in the system_server, via the EntropyMixer code. Unfortunately, the EntropyMixer code runs fairly late in the boot process, which means early boot doesn't have high quality entropy. This has caused security problems in the past. Load entropy data as soon as we can in the early boot process, so that we can get /dev/random / /dev/urandom into a "random" state earlier. Bug: 9983133 Change-Id: Id4a6f39e9060f30fe7497bd8f8085a9bec851e80 --- rootdir/init.rc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/rootdir/init.rc b/rootdir/init.rc index 19ab6cc7e..be74f6fc2 100644 --- a/rootdir/init.rc +++ b/rootdir/init.rc @@ -177,6 +177,9 @@ on post-fs-data # We restorecon /data in case the userdata partition has been reset. restorecon /data + # Avoid predictable entropy pool. Carry over entropy from previous boot. + copy /data/system/entropy.dat /dev/urandom + # Create dump dir and collect dumps. # Do this before we mount cache so eventually we can use cache for # storing dumps on platforms which do not have a dedicated dump partition.