Seeding the Linux RNG at first boot

[Leo Famulari]

On Wed, Dec 06, 2017 at 12:11:36AM +0100, Marius Bakke wrote:
> FWIW if you control the hypervisor, you can send something along the
> lines of:
> 
> qemu -device virtio-rng-pci,bus=pci.0,addr=0x1e,max-bytes=1024,period=1000
> 
> to feed the guest with entropy from the host through virtio, up to 1kB/s.

Exactly, this is along the lines of what I'm thinking for `guix system
vm`.

On the guest side, we would extend urandom-seed-service to also draw on
/dev/hwrng, which is where virtio-rng-pci makes the data from the host
available.

Currently there is the rngd-service-type, but that is doing something
slightly different. Using /dev/hwrng to seed urandom could be done
whenever it's enabled in the kernel.

I have an idea for another improvement: to add an argument like
"--entropy-seed=" to `guix system` that could place the value in
'/var/lib/random-seed', where it would be used on first boot.

Thoughts?

signature.asc
Description: PGP signature