]>
Commit | Line | Data |
---|---|---|
edcf89be LP |
1 | <?xml version="1.0"?> |
2 | <!--*-nxml-*--> | |
3a54a157 | 3 | <!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" |
eea10b26 | 4 | "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd"> |
db9ecf05 | 5 | <!-- SPDX-License-Identifier: LGPL-2.1-or-later --> |
4623eecb AK |
6 | <refentry id="systemd-random-seed.service" conditional='ENABLE_RANDOMSEED' |
7 | xmlns:xi="http://www.w3.org/2001/XInclude"> | |
edcf89be | 8 | |
798d3a52 ZJS |
9 | <refentryinfo> |
10 | <title>systemd-random-seed.service</title> | |
11 | <productname>systemd</productname> | |
798d3a52 | 12 | </refentryinfo> |
edcf89be | 13 | |
798d3a52 ZJS |
14 | <refmeta> |
15 | <refentrytitle>systemd-random-seed.service</refentrytitle> | |
16 | <manvolnum>8</manvolnum> | |
17 | </refmeta> | |
edcf89be | 18 | |
798d3a52 ZJS |
19 | <refnamediv> |
20 | <refname>systemd-random-seed.service</refname> | |
21 | <refname>systemd-random-seed</refname> | |
921fc451 | 22 | <refpurpose>Load and save the OS system random seed at boot and shutdown</refpurpose> |
798d3a52 | 23 | </refnamediv> |
edcf89be | 24 | |
798d3a52 ZJS |
25 | <refsynopsisdiv> |
26 | <para><filename>systemd-random-seed.service</filename></para> | |
b4e5c103 | 27 | <para><filename>/usr/lib/systemd/systemd-random-seed</filename></para> |
798d3a52 | 28 | </refsynopsisdiv> |
edcf89be | 29 | |
798d3a52 ZJS |
30 | <refsect1> |
31 | <title>Description</title> | |
edcf89be | 32 | |
39867bb9 LP |
33 | <para><filename>systemd-random-seed.service</filename> is a service that loads an on-disk random seed |
34 | into the kernel entropy pool during boot and saves it at shutdown. See | |
35 | <citerefentry><refentrytitle>random</refentrytitle><manvolnum>4</manvolnum></citerefentry> for | |
36 | details. By default, no entropy is credited when the random seed is written into the kernel entropy pool, | |
b66a6e1a | 37 | but this may be changed with <varname>$SYSTEMD_RANDOM_SEED_CREDIT</varname>, see below. On disk the random |
39867bb9 LP |
38 | seed is stored in <filename>/var/lib/systemd/random-seed</filename>.</para> |
39 | ||
40 | <para>Note that this service runs relatively late during the early boot phase, i.e. generally after the | |
b66a6e1a ZJS |
41 | initrd phase has finished and the <filename>/var/</filename> file system has been mounted. Many system |
42 | services require entropy much earlier than this — this service is hence of limited use for complex | |
43 | system. It is recommended to use a boot loader that can pass an initial random seed to the kernel to | |
44 | ensure that entropy is available from earliest boot on, for example | |
39867bb9 LP |
45 | <citerefentry><refentrytitle>systemd-boot</refentrytitle><manvolnum>7</manvolnum></citerefentry>, with |
46 | its <command>bootctl random-seed</command> functionality.</para> | |
47 | ||
e9dd6984 | 48 | <para>When loading the random seed from disk, the file is immediately updated with a new seed retrieved |
39867bb9 LP |
49 | from the kernel, in order to ensure no two boots operate with the same random seed. This new seed is |
50 | retrieved synchronously from the kernel, which means the service will not complete start-up until the | |
51 | random pool is fully initialized. On entropy-starved systems this may take a while. This functionality is | |
52 | intended to be used as synchronization point for ordering services that require an initialized entropy | |
53 | pool to function securely (i.e. services that access <filename>/dev/urandom</filename> without any | |
54 | further precautions).</para> | |
55 | ||
56 | <para>Care should be taken when creating OS images that are replicated to multiple systems: if the random | |
57 | seed file is included unmodified each system will initialize its entropy pool with the same data, and | |
58 | thus — if otherwise entropy-starved — generate the same or at least guessable random seed streams. As a | |
59 | safety precaution crediting entropy is thus disabled by default. It is recommended to remove the random | |
60 | seed from OS images intended for replication on multiple systems, in which case it is safe to enable | |
8f39ecf6 LP |
61 | entropy crediting, see below. Also see <ulink url="https://systemd.io/BUILDING_IMAGES">Safely Building |
62 | Images</ulink>.</para> | |
93f59100 LP |
63 | |
64 | <para>See <ulink url="https://systemd.io/RANDOM_SEEDS">Random Seeds</ulink> for further | |
65 | information.</para> | |
39867bb9 LP |
66 | </refsect1> |
67 | ||
68 | <refsect1> | |
69 | <title>Environment</title> | |
70 | ||
71 | <variablelist class='environment-variables'> | |
72 | <varlistentry> | |
73 | <term><varname>$SYSTEMD_RANDOM_SEED_CREDIT</varname></term> | |
74 | <listitem><para>By default, <filename>systemd-random-seed.service</filename> does not credit any | |
75 | entropy when loading the random seed. With this option this behaviour may be changed: it either takes | |
76 | a boolean parameter or the special string <literal>force</literal>. Defaults to false, in which case | |
77 | no entropy is credited. If true, entropy is credited if the random seed file and system state pass | |
78 | various superficial concisistency checks. If set to <literal>force</literal> entropy is credited, | |
ec07c3c8 AK |
79 | regardless of these checks, as long as the random seed file exists.</para> |
80 | ||
81 | <xi:include href="version-info.xml" xpointer="v243"/></listitem> | |
39867bb9 LP |
82 | </varlistentry> |
83 | </variablelist> | |
798d3a52 | 84 | </refsect1> |
edcf89be | 85 | |
798d3a52 ZJS |
86 | <refsect1> |
87 | <title>See Also</title> | |
13a69c12 DT |
88 | <para><simplelist type="inline"> |
89 | <member><citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry></member> | |
90 | <member><citerefentry><refentrytitle>random</refentrytitle><manvolnum>4</manvolnum></citerefentry></member> | |
91 | <member><citerefentry><refentrytitle>systemd-boot</refentrytitle><manvolnum>7</manvolnum></citerefentry></member> | |
92 | <member><citerefentry><refentrytitle>systemd-stub</refentrytitle><manvolnum>7</manvolnum></citerefentry></member> | |
93 | <member><citerefentry><refentrytitle>bootctl</refentrytitle><manvolnum>4</manvolnum></citerefentry></member> | |
94 | <member><citerefentry><refentrytitle>systemd-boot-random-seed.service</refentrytitle><manvolnum>8</manvolnum></citerefentry></member> | |
95 | </simplelist></para> | |
798d3a52 | 96 | </refsect1> |
edcf89be LP |
97 | |
98 | </refentry> |