Add /boot/entropy at install time, and be more careful with permissions

[dteske]

Summary

Now that /boot/entropy is loaded by loader at boot time, we should generate this file also at install time.

We were also not being explicit about permissions on these files, so make sure that if umask or other things changes, that these will have correct permissions. We should probably also updated the rc.d scripts to do the same incase they are created by hand.

In the case /entropy is created by hand w/ incorrect permissions, no script fixes this.

Related: https://github.com/HardenedBSD/hardenedBSD/issues/167

[markm]

This was on my TODO list. I wish I'd known it was this simple!

usr.sbin/bsdinstall/scripts/entropy

29–33

The double quotes are superfluous, but not a particularly big deal.

[jmg]

I had thought that we weren't writing out even /entropy files, but @op pointed me to this file.

usr.sbin/bsdinstall/scripts/entropy

29–33

only if BSDINSTALL_CHROOT is guaranteed to never have spaces in it, and as this is passed in externally, I prefer not to make that assumption.

[jmg]

Well, I attempted to test this, and I don't believe that this file is being called at the end of install.

I d/l'd FreeBSD-11.0-CURRENT-amd64-20151016-r289420-disc1.iso, and put the new entropy file in the iso manually via:
strings -td FreeBSD-11.0-CURRENT-amd64-20151016-r289420-disc1.iso | grep 'BSDINSTALL_CHROOT/entropy'
echo $((659639709/2048))

Then:
dd if=FreeBSD-11.0-CURRENT-amd64-20151016-r289420-disc1.iso bs=2k iseek=322089 count=1 | hexdump -C | less
to verify that I had the correct file,

and then:
dd if=/tmp/entropy conv=notrunc of=FreeBSD-11.0-CURRENT-amd64-20151016-r289420-disc1.iso bs=2k oseek=322089 count=1

to overwrite the file...

I then used bhyve to do an install:
truncate -s 4g 11snap.img
sh /usr/share/examples/bhyve/vmrun.sh -m 4g -d 11snap.img -I FreeBSD-11.0-CURRENT-amd64-20151016-r289420-disc1.iso 11snap

Then selected all the defaults for an install, and when it was done and rebooted, I booted single user mode, and inspected the fs, and found that neither /entropy nor /boot/entropy were created.

[jmg]

• add /boot/entropy to install generation.. Also, be extra careful
• add quotes around the $i for more space protection..

I have done a basic test, and this looks good, I'll commit shortly..

[jmg]

though using dd to put it in an image works, it doesn't change the file size, so I needed to delete some comments, and add white space... once I did that, I was able to verify that the script ran fine...

[markm]

I'm happy.

[op]

In D3933#81686, @markm wrote:

This was on my TODO list. I wish I'd known it was this simple!

Could you please share your TODO list somewhere?

[op]

In D3933#81711, @jmg wrote:

• add /boot/entropy to install generation.. Also, be extra careful
• add quotes around the $i for more space protection..

I have done a basic test, and this looks good, I'll commit shortly..

We have one more issue in relation to this bug: https://github.com/HardenedBSD/hardenedBSD/commit/73e53f0af947e9ad77653f44ef99a2d66394789c

Possible the current candidate supersede this change. I will test them today.

[delphij]

Perhaps we can use umask instead?

Also do we really need bsdinstall entropy when creating a jail? (Note that /etc/rc.d/random have nojail in it, so it's not actually being used there).

usr.sbin/bsdinstall/scripts/entropy

32

Instead of this can we just do umask 077 before the dd and umask 022 after it?

[jmg]

for jails we don't need to create the file, but I don't see any harm in having this file created... I looked briefly at the jail script, and I don't see a good way to turn it off in the jail case...

usr.sbin/bsdinstall/scripts/entropy

32

hmm.. We should just do umask 077 and not restore after.. I just confirmed w/ dteske that these scripts are executed, not sourced.

[jmg]

• add /boot/entropy to install generation.. Also, be extra careful
• add quotes around the $i for more space protection..
• use umask per delphij...

[jmg]

mark various parts done

[dteske]

Take

[dteske]

Remove unnecessary sub-shell (bsdinstall verbs are exec'd;
no need to protect environment from umask effects).

[dteske]

Refactor

[jmg]

take back so I can update and confirm my change is same..

[jmg]

• add /boot/entropy to install generation.. Also, be extra careful
• add quotes around the $i for more space protection..
• use umask per delphij...
• dteske says the parens are not needed.. remove them..

[jmg]

• add /boot/entropy to install generation.. Also, be extra careful
• add quotes around the $i for more space protection..
• use umask per delphij...
• dteske says the parens are not needed.. remove them..
• pull in dteske's version..

[dteske]

So sorry to commandeer again; but I have to fix a mistake in my previous code which was written hastily during the conference

[dteske]

Fix prior refactoring

[dteske]

Please re-commandeer. Sorry for prior misgiving (refactoring was ``off'' for chown(8) at end of for-loop).

[delphij]

Looks good to me.

[markm]

I'm still Happy!

[op]

Any update on this change?

[delphij]

Hrm I thought Devin have already integrated this weeks ago but a quick glance suggests it's not. Devin, looks like all issues was resolved already?

[dteske]

See prior comment; I asked jmg to re-commandeer for the commit. I only commandeered it so I could update it -- had no intention of truly owning it and wanted jmg to drive it.

But... it looks like jmg is relinquishing to me by way of implicit ETIMEOUT on taking-back.
I'll go ahead and drive this in (most likely by EOD today).

[delphij]

In D3933#89226, @dteske wrote:

See prior comment; I asked jmg to re-commandeer for the commit. I only commandeered it so I could update it -- had no intention of truly owning it and wanted jmg to drive it.

But... it looks like jmg is relinquishing to me by way of implicit ETIMEOUT on taking-back.
I'll go ahead and drive this in (most likely by EOD today).

Ping? :) @dteske @jmg

[dteske]

Committed to HEAD as SVN r292832 -- will merge to stable/{9,10} after MFC timeout