unbound service: non-blocking random in chroot
/dev/random is an exhaustible resource. Presumably, unbound will not be used to generate long-term encryption keys and so allowing it to use /dev/random only increases the risk of entropy exhaustion for no benefit.
This commit is contained in:
parent
7980523e00
commit
52432ee63d
@ -115,7 +115,7 @@ in
|
||||
chown unbound ${stateDir} ${rootTrustAnchorFile}
|
||||
''}
|
||||
touch ${stateDir}/dev/random
|
||||
${pkgs.utillinux}/bin/mount --bind -n /dev/random ${stateDir}/dev/random
|
||||
${pkgs.utillinux}/bin/mount --bind -n /dev/urandom ${stateDir}/dev/random
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
|
Loading…
Reference in New Issue
Block a user