boot: remove random-seed-mode

Now that the random seed is used on virtualized systems, there's no
point in having a random-seed-mode toggle switch. Let's just always
require it now, with the existing logic already being there to allow not
having it if EFI itself has an RNG. In other words, the logic for this
can now be automatic.
This commit is contained in:
Jason A. Donenfeld
2022-11-22 01:30:03 +01:00
committed by Luca Boccassi
parent a0c544ee09
commit 47b3e96647
7 changed files with 5 additions and 77 deletions
-8
View File
@@ -232,14 +232,6 @@ boot, in order to ensure the entropy pool is filled up quickly.
too), which should be safe even with FAT file system drivers built into
low-quality EFI firmwares.
If the system token is not desired but this seeding mechanism still is, OS
builders that know that they are not going to replicate the built image on
multiple systems may opt to turn off the 'system token' concept by setting
`random-seed-mode always` in the ESP's
[`/loader/loader.conf`](https://www.freedesktop.org/software/systemd/man/loader.conf.html)
file. If done, `systemd-boot` will use the random seed file even if no
system token is found in EFI variables.
4. A kernel command line option `systemd.random_seed=` may be used to pass in a
base64 encoded seed to initialize the kernel's entropy pool from during
early service manager initialization. This option is only safe in testing