Index: head/libexec/rc/rc.d/random
===================================================================
--- head/libexec/rc/rc.d/random	(revision 348121)
+++ head/libexec/rc/rc.d/random	(revision 348122)
@@ -1,164 +1,155 @@
 #!/bin/sh
 #
 # $FreeBSD$
 #
 
 # PROVIDE: random
 # REQUIRE: FILESYSTEMS
 # BEFORE: netif
 # KEYWORD: nojail shutdown
 
 . /etc/rc.subr
 
 name="random"
 desc="Harvest and save entropy for random device"
 start_cmd="random_start"
 stop_cmd="random_stop"
 
 extra_commands="saveseed"
 saveseed_cmd="${name}_stop"
 
 save_dev_random()
 {
 	oumask=`umask`
 	umask 077
 	for f ; do
 		debug "saving entropy to $f"
 		dd if=/dev/random of="$f" bs=4096 count=1 status=none &&
+			( chflags nodump "$f" 2>/dev/null || : ) &&
 			chmod 600 "$f" &&
 			fsync "$f" "$(dirname "$f")"
 	done
 	umask ${oumask}
 }
 
 feed_dev_random()
 {
 	for f ; do
 		if [ -f "$f" -a -r "$f" -a -s "$f" ] ; then
 			if dd if="$f" of=/dev/random bs=4096 2>/dev/null ; then
 				debug "entropy read from $f"
 				rm -f "$f"
 			fi
 		fi
 	done
 }
 
 random_start()
 {
 
 	if [ ${harvest_mask} -gt 0 ]; then
 		echo -n 'Setting up harvesting: '
 		${SYSCTL} kern.random.harvest.mask=${harvest_mask} > /dev/null
 		${SYSCTL_N} kern.random.harvest.mask_symbolic
 	fi
 
 	echo -n 'Feeding entropy: '
 
 	if [ ! -w /dev/random ] ; then
 		warn "/dev/random is not writeable"
 		return 1
 	fi
 
 	# Reseed /dev/random with previously stored entropy.
 	case ${entropy_dir:=/var/db/entropy} in
 	[Nn][Oo])
 		;;
 	*)
 		if [ -d "${entropy_dir}" ] ; then
 			feed_dev_random "${entropy_dir}"/*
 		fi
 		;;
 	esac
 
 	case ${entropy_file:=/entropy} in
 	[Nn][Oo])
 		;;
 	*)
 		feed_dev_random "${entropy_file}" /var/db/entropy-file
 		save_dev_random "${entropy_file}"
 		;;
 	esac
 
 	case ${entropy_boot_file:=/boot/entropy} in
 	[Nn][Oo])
 		;;
 	*)
 		save_dev_random "${entropy_boot_file}"
 		;;
 	esac
 
 	echo '.'
 }
 
 random_stop()
 {
 	# Write some entropy so when the machine reboots /dev/random
 	# can be reseeded
 	#
 	case ${entropy_file:=/entropy} in
 	[Nn][Oo])
 		;;
 	*)
-		echo -n 'Writing entropy file:'
+		echo -n 'Writing entropy file: '
 		rm -f ${entropy_file} 2> /dev/null
 		oumask=`umask`
 		umask 077
 		if touch ${entropy_file} 2> /dev/null; then
 			entropy_file_confirmed="${entropy_file}"
 		else
 			# Try this as a reasonable alternative for read-only
 			# roots, diskless workstations, etc.
 			rm -f /var/db/entropy-file 2> /dev/null
 			if touch /var/db/entropy-file 2> /dev/null; then
 				entropy_file_confirmed=/var/db/entropy-file
 			fi
 		fi
 		case ${entropy_file_confirmed} in
 		'')
 			warn 'write failed (read-only fs?)'
 			;;
 		*)
-			dd if=/dev/random of=${entropy_file_confirmed} \
-			    bs=4096 count=1 2> /dev/null ||
-			    warn 'write failed (unwriteable file or full fs?)'
-			fsync "${entropy_file_confirmed}" \
-			    "$(dirname "${entropy_file_confirmed}")" \
-			    2> /dev/null
+			save_dev_random "${entropy_file_confirmed}"
 			echo '.'
 			;;
 		esac
 		umask ${oumask}
 		;;
 	esac
 	case ${entropy_boot_file:=/boot/entropy} in
 	[Nn][Oo])
 		;;
 	*)
-		echo -n 'Writing early boot entropy file:'
+		echo -n 'Writing early boot entropy file: '
 		rm -f ${entropy_boot_file} 2> /dev/null
 		oumask=`umask`
 		umask 077
 		if touch ${entropy_boot_file} 2> /dev/null; then
 			entropy_boot_file_confirmed="${entropy_boot_file}"
 		fi
 		case ${entropy_boot_file_confirmed} in
 		'')
 			warn 'write failed (read-only fs?)'
 			;;
 		*)
-			dd if=/dev/random of=${entropy_boot_file_confirmed} \
-			    bs=4096 count=1 2> /dev/null ||
-			    warn 'write failed (unwriteable file or full fs?)'
-			fsync "${entropy_boot_file_confirmed}" \
-			    "$(dirname "${entropy_boot_file_confirmed}")" \
-			    2> /dev/null
+			save_dev_random "${entropy_boot_file_confirmed}"
 			echo '.'
 			;;
 		esac
 		umask ${oumask}
 		;;
 	esac
 }
 
 load_rc_config $name
 run_rc_command "$1"
Index: head/libexec/save-entropy/save-entropy.sh
===================================================================
--- head/libexec/save-entropy/save-entropy.sh	(revision 348121)
+++ head/libexec/save-entropy/save-entropy.sh	(revision 348122)
@@ -1,95 +1,96 @@
 #!/bin/sh
 #
 # SPDX-License-Identifier: BSD-2-Clause-FreeBSD
 #
 # Copyright (c) 2001-2006,2012 Douglas Barton, dougb@FreeBSD.org
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
 # are met:
 # 1. Redistributions of source code must retain the above copyright
 #    notice, this list of conditions and the following disclaimer.
 # 2. Redistributions in binary form must reproduce the above copyright
 #    notice, this list of conditions and the following disclaimer in the
 #    documentation and/or other materials provided with the distribution.
 #
 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 # ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 #
 # $FreeBSD$
 
 # This script is called by cron to store bits of randomness which are
 # then used to seed /dev/random on boot.
 
 # Originally developed by Doug Barton, dougb@FreeBSD.org
 
 PATH=/bin:/usr/bin
 
 # If there is a global system configuration file, suck it in.
 #
 if [ -r /etc/defaults/rc.conf ]; then
 	. /etc/defaults/rc.conf
 	source_rc_confs 2>/dev/null
 elif [ -r /etc/rc.conf ]; then
 	. /etc/rc.conf 2>/dev/null
 fi
 
 [ $(/sbin/sysctl -n security.jail.jailed) = 0 ] || exit 0
 
 case ${entropy_dir} in
 [Nn][Oo])
 	exit 0
 	;;
 *)
 	entropy_dir=${entropy_dir:-/var/db/entropy}
 	;;
 esac
 
 entropy_save_sz=${entropy_save_sz:-4096}
 entropy_save_num=${entropy_save_num:-8}
 
 if [ ! -d "${entropy_dir}" ]; then
 	install -d -o operator -g operator -m 0700 "${entropy_dir}" || {
 		logger -is -t "$0" The entropy directory "${entropy_dir}" does \
 		    not exist, and cannot be created. Therefore no entropy can \
 		    be saved.; exit 1; }
 fi
 
 cd "${entropy_dir}" || {
 	logger -is -t "$0" Cannot cd to the entropy directory: "${entropy_dir}". \
 	    Entropy file rotation is aborted.; exit 1; }
 
 for f in saved-entropy.*; do
 	case "${f}" in saved-entropy.\*) continue ;; esac	# No files match
 	[ ${f#saved-entropy\.} -ge ${entropy_save_num} ] && unlink ${f}
 done
 
 umask 377
 
 n=$(( ${entropy_save_num} - 1 ))
 while [ ${n} -ge 1 ]; do
 	if [ -f "saved-entropy.${n}" ]; then
 		mv "saved-entropy.${n}" "saved-entropy.$(( ${n} + 1 ))"
 	elif [ -e "saved-entropy.${n}" -o -L "saved-entropy.${n}" ]; then
 		logger -is -t "$0" \
 	"${entropy_dir}/saved-entropy.${n}" is not a regular file, and so \
 	    it will not be rotated. Entropy file rotation is aborted.
 		exit 1
 	fi
 	n=$(( ${n} - 1 ))
 done
 
 dd if=/dev/random of=saved-entropy.1 bs=${entropy_save_sz} count=1 2>/dev/null
+chflags nodump saved-entropy.1 2>/dev/null || :
 fsync saved-entropy.1 "."
 
 exit 0