You are not logged in.
Can anyone help me with passing "Random Seed" to the kernel? I seems that the loader does not pass the Random Seed file to the OS regardless of my loader.conf configuration.
I am experiencing a long pause after the loader, before the kernel starts booting. I guess this happens to the lack of random data collection.
Random Seed:
Passed to OS: no
System Token: set
Exists: yesI generated the random seed file with bootctl:
$ sudo bootctl random-seed
$ sudo bootctl set-default linux-signed.efiI tried all the following options one by one in loader.conf:
random-seed-mode off
random-seed-mode with-system-token
random-seed-mode alwaysEven with "random-mode always" the random seed is not passed. According to "man loader.conf" setting "always" should lead to passing the random seed file, regardless of other configuration.
But this does not happen for me.
Here is my current configuration:
$ tree
.
├── EFI
│ ├── BOOT
│ │ └── BOOTX64.EFI
│ ├── Linux
│ │ └── linux-signed.efi
│ └── systemd
│ └── systemd-bootx64.efi
├── initramfs-linux-fallback.img
├── initramfs-linux.img
├── intel-ucode.img
├── keytool.efi
├── loader
│ ├── entries
│ │ ├── arch.conf
│ │ ├── arch-fallback.conf
│ │ └── uefi-keytool.conf
│ ├── loader.conf
│ └── random-seed
├── shellx64.efi
└── vmlinuz-linux$ bootctl status
System:
Firmware: UEFI 2.40 (Lenovo 0.5232)
Secure Boot: enabled
Setup Mode: user
Boot into FW: supported
Current Boot Loader:
Product: systemd-boot 247.2-1-arch
Features: ✓ Boot counting
✓ Menu timeout control
✓ One-shot menu timeout control
✓ Default entry control
✓ One-shot entry control
✓ Support for XBOOTLDR partition
✓ Support for passing random seed to OS
✓ Boot loader sets ESP partition information
Stub: systemd-stub 247.2-1-arch
ESP: /dev/disk/by-partuuid/8860aa35-bd34-47f8-8a95-bbacb3592234
File: └─/EFI/systemd/systemd-bootx64.efi
Random Seed:
Passed to OS: no
System Token: set
Exists: yes
Available Boot Loaders on ESP:
ESP: /boot (/dev/disk/by-partuuid/8860aa35-bd34-47f8-8a95-bbacb3592234)
File: └─/EFI/systemd/systemd-bootx64.efi (systemd-boot 247.2-1-arch)
File: └─/EFI/BOOT/BOOTX64.EFI (systemd-boot 247.2-1-arch)
Boot Loaders Listed in EFI Variables:
Title: Linux Boot Manager
ID: 0x0000
Status: active, boot-order
Partition: /dev/disk/by-partuuid/8860aa35-bd34-47f8-8a95-bbacb3592234
File: └─/EFI/systemd/systemd-bootx64.efi
Boot Loader Entries:
$BOOT: /boot (/dev/disk/by-partuuid/8860aa35-bd34-47f8-8a95-bbacb3592234)
Default Boot Loader Entry:
title: Arch Linux (linux-signed.efi)
id: linux-signed.efi
source: /boot/EFI/Linux/linux-signed.efi
linux: EFI/Linux/linux-signed.efi
options: cryptdevice=/dev/nvme0n1p2:vg0:allow-discards root=/dev/mapper/vg0-root ro resume=/dev/mapper/vg0-swap hibernate=nocompress init=/usr/lib/systemd/systemd apparmor=0 audit=0 intel_iommu=igfx_off intremap=no_x2apic_optout acpi_force_table_verification pcie_aspm=force nmi_watchdog=0 nowatchdog kvm-intel.ept=0 psmouse.synaptics_intertouch=1 btusb.enable_autosuspend=0 lang=de locale=de_DE.UTF-8$ systemctl status systemd-boot-system-token.service
● systemd-boot-system-token.service - Store a System Token in an EFI Variable
Loaded: loaded (/usr/lib/systemd/system/systemd-boot-system-token.service; static)
Active: active (exited) since Tue 2021-01-12 10:13:22 CET; 23min ago
Docs: man:systemd-boot-system-token.service(8)
Process: 574 ExecStart=bootctl random-seed --graceful (code=exited, status=0/SUCCESS)
Main PID: 574 (code=exited, status=0/SUCCESS)
Jan 12 10:13:21 archlinux-5084f53a systemd[1]: Starting Store a System Token in an EFI Variable...
Jan 12 10:13:22 archlinux-5084f53a bootctl[574]: Random seed file /boot/loader/random-seed successfully written (512 bytes).
Jan 12 10:13:22 archlinux-5084f53a systemd[1]: Finished Store a System Token in an EFI Variable.$ systemctl cat systemd-boot-system-token.service
# /usr/lib/systemd/system/systemd-boot-system-token.service
# SPDX-License-Identifier: LGPL-2.1-or-later
#
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
[Unit]
Description=Store a System Token in an EFI Variable
Documentation=man:systemd-boot-system-token.service(8)
DefaultDependencies=no
Conflicts=shutdown.target
After=local-fs.target systemd-random-seed.service
Before=shutdown.target
# Don't run this in a VM environment, because there EFI variables are not
# actually stored in NVRAM, independent of regular storage.
ConditionVirtualization=no
# Only run this if the boot loader can support random seed initialization.
ConditionPathExists=/sys/firmware/efi/efivars/LoaderFeatures-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
# Only run this if there is no system token defined yet, or …
ConditionPathExists=|!/sys/firmware/efi/efivars/LoaderSystemToken-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
# … if the boot loader didn't pass the OS a random seed (and thus probably was missing the random seed file)
ConditionPathExists=|!/sys/firmware/efi/efivars/LoaderRandomSeed-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=bootctl random-seed --gracefulIf i read the conditions of the service correctly, the loader has the ability to pass the random-seed file, a system token is present, but the loader did not passed the seed:
$ LANG=C ls -l /sys/firmware/efi/efivars/LoaderFeatures-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
-rw-r--r-- 1 root root 12 Jan 12 10:13 /sys/firmware/efi/efivars/LoaderFeatures-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
$ LANG=C ls -l /sys/firmware/efi/efivars/LoaderSystemToken-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
-rw------- 1 root root 516 Jan 12 10:13 /sys/firmware/efi/efivars/LoaderSystemToken-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
$ LANG=C ls -l /sys/firmware/efi/efivars/LoaderRandomSeed-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
ls: can not access '/sys/firmware/efi/efivars/LoaderRandomSeed-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f': No such file or directoryThank you, for looking into this!
edit: corrected tags
Last edited by mushotoku (2021-01-12 20:15:36)
Offline
I would suggest booting with the kernel parameter systemd.log_level=debug then look for one the messages from the code below in the journal.
Offline
Systemd never passes seed to kernel when secureboot is enabled, see https://github.com/systemd/systemd/issues/16328 . You may temporarily disable secureboot to confirm this.
Offline
Systemd never passes seed to kernel when secureboot is enabled, see https://github.com/systemd/systemd/issues/16328 . You may temporarily disable secureboot to confirm this.
Confirmed. Thank you very much, Everette88!
$ bootctl status
System:
Firmware: UEFI 2.40 (Lenovo 0.5232)
Secure Boot: disabled
Setup Mode: user
Boot into FW: supported
[...]
Random Seed:
Passed to OS: yes
System Token: set
Exists: yesAfter reading the issue on GitHub from your link, it makes perfekt sense to me, now that I think about it.
IMHO should have given a line in the manpage LOADER.CONF(5) or somewhere else.
Again, thank you!
Offline