The urandom-seed-service preserves some of the Linux cryptographic random number generator's (CRNG) pool across reboots so that freshly booted systems have access to unpredictable psuedorandom numbers. It also tries to take advantage of whatever is backing /dev/hwrng.
However, the urandom-seed-service may not be started before certain applications that assume a good source of randomness. In some cases, the applications require some random data before any services are started, during activation. For example, our OpenSSH service generates its host keys during activation. And even if it generated host keys during the start of the OpenSSH service, that service does not depend on urandom-seed-service. [0] In systemd, there is an abstract sysinit "target" that basically serves as a checkpoint. All the lower-level system initialization is required before the sysinit.target is met, and the rest of the services depend on sysinit. The random seeding is part of sysinit. I've reproduced a graph of this in [1]. In practice, I'm not sure if it matters. I'd appreciate if GuixSD users could check /var/log/messages for warnings like this one and report them: random: application: uninitialized urandom read (16 bytes read) And I'd also appreciate any feedback or ideas for improvement in this area. [0] See the attached service graph of a bare-bones system with OpenSSH. [1] from: <https://www.freedesktop.org/software/systemd/man/bootup.html> local-fs-pre.target | v (various mounts and (various swap (various cryptsetup fsck services...) devices...) devices...) (various low-level (various low-level | | | services: udevd, API VFS mounts: v v v tmpfiles, random mqueue, configfs, local-fs.target swap.target cryptsetup.target seed, sysctl, ...) debugfs, ...) | | | | | \__________________|_________________ | ___________________|____________________/ \|/ v sysinit.target | ____________________________________/|\________________________________________ / | | | \ | | | | | v v | v v (various (various | (various rescue.service timers...) paths...) | sockets...) | | | | | v v v | v rescue.target timers.target paths.target | sockets.target | | | | v \_________________ | ___________________/ \|/ v basic.target | ____________________________________/| emergency.service / | | | | | | v v v v emergency.target display- (various system (various system manager.service services services) | required for | | graphical UIs) v | | multi-user.target | | | \_________________ | _________________/ \|/ v graphical.target
signature.asc
Description: PGP signature
