unbound service: non-blocking random in chroot

/dev/random is an exhaustible resource. Presumably, unbound will not be
used to generate long-term encryption keys and so allowing it to use
/dev/random only increases the risk of entropy exhaustion for no
benefit.
This commit is contained in:
Joachim Fasting 2016-08-30 19:22:53 +02:00
parent 7980523e00
commit 52432ee63d
No known key found for this signature in database
GPG Key ID: 7544761007FE4E08

View File

@ -115,7 +115,7 @@ in
chown unbound ${stateDir} ${rootTrustAnchorFile}
''}
touch ${stateDir}/dev/random
${pkgs.utillinux}/bin/mount --bind -n /dev/random ${stateDir}/dev/random
${pkgs.utillinux}/bin/mount --bind -n /dev/urandom ${stateDir}/dev/random
'';
serviceConfig = {