Leo Famulari <l...@famulari.name> skribis: > On Wed, Dec 06, 2017 at 12:11:36AM +0100, Marius Bakke wrote: >> FWIW if you control the hypervisor, you can send something along the >> lines of: >> >> qemu -device virtio-rng-pci,bus=pci.0,addr=0x1e,max-bytes=1024,period=1000 >> >> to feed the guest with entropy from the host through virtio, up to 1kB/s. > > Exactly, this is along the lines of what I'm thinking for `guix system > vm`. > > On the guest side, we would extend urandom-seed-service to also draw on > /dev/hwrng, which is where virtio-rng-pci makes the data from the host > available.
Maybe ‘virtualized-operating-system’ in (gnu system vm) could automatically customize ‘rngd-service-type’ (or add it)? > Currently there is the rngd-service-type, but that is doing something > slightly different. Using /dev/hwrng to seed urandom could be done > whenever it's enabled in the kernel. > > I have an idea for another improvement: to add an argument like > "--entropy-seed=" to `guix system` that could place the value in > '/var/lib/random-seed', where it would be used on first boot. We could do that, though I very much prefer the idea of a “backdoor” à la virtio-rng-pci, because it allows to stick to bit-reproducible images (well, they’re not bit-reproducible yet I suppose, but let’s not add to it.) WDYT? Ludo’.
