Processed: Re: Bug#914297: apache2: getrandom call blocks on first startup, systemd kills with timeout

[Debian Bug Tracking System]

clone 914297 -1

Bug #914297 [systemd] allow crediting the seed file for some entropy
Bug 914297 cloned as bug 916690

reassign -1 release-notes

Bug #916690 [systemd] allow crediting the seed file for some entropy
Bug reassigned from package 'systemd' to 'release-notes'.
Ignoring request to alter found versions of bug #916690 to the same values previously set
Ignoring request to alter fixed versions of bug #916690 to the same values previously set

retitle -1 document getrandom changes causing entropy starvation

Bug #916690 [release-notes] allow crediting the seed file for some entropy
Changed Bug title to 'document getrandom changes causing entropy starvation' from 'allow crediting the seed file for some entropy'.

thanks

Stopping processing here.

Please contact me if you need assistance.

[Paul Gevers]

Hi,

And yes, at this point I think the only solution is to document this in
the release notes.

I asked DLange on IRC and he is willing to come up with a proper text
for this in due time if the situation can't be improved.

https://daniel-lange.com/archives/152-Openssh-taking-minutes-to-become-available,-booting-takes-half-an-hour-...-because-your-server-waits-for-a-few-bytes-of-randomness.html

Paul

[Debian Bug Tracking System]

Your message dated Tue, 7 May 2019 22:24:59 +0200
with message-id <45f35697-4fec-3fcf-3e9b-***@debian.org>
and subject line Re: Bug#916690: [release-notes] document getrandom changes causing entropy starvation
has caused the Debian Bug report #916690,
regarding document getrandom changes causing entropy starvation
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ***@bugs.debian.org
immediately.)

[Justin B Rye]

https://salsa.debian.org/ddp-team/release-notes/commit/5f76abd and
follow up commit.

A couple of tweaks -

<section id="entropy-starvation">
<!-- stretch to buster -->
- <title>daemons fail to start or system appears to hang during boot</title>
+ <title>Daemons fail to start or system appears to hang during boot</title>

Other titles with initial lowercase are doing it because the first
word is a literal string.

<para>
Due to <systemitem role="package">systemd</systemitem> needing entropy
during boot and the kernel treating such calls as blocking when available
entropy is low, the system may hang for minutes to hours until the
randomness subsystem is sufficiently initialized (<literal>random: crng
init done</literal>). For <literal>amd64</literal> systems supporting the
- <literal>RDRAND</literal> instruction this issue is mediated by the
+ <literal>RDRAND</literal> instruction this issue is avoided by the
Debian kernel using this instruction by default
(<literal>CONFIG_RANDOM_TRUST_CPU</literal>).
</para>

I think the word this was going for was "remediated" (i.e. "cured")
rather than "mediated" (i.e. "indirectly caused"), but it's probably
best to use something simpler.

<para>
- Non-<literal>amd64</literal> systems and some type of virtual machines
+ Non-<literal>amd64</literal> systems and some types of virtual machines
need to provide a different source of entropy to continue fast booting.
<systemitem role="package">haveged</systemitem> has been chosen for this
within the Debian Installer project and may be a valid option if hardware

Multiple types of VMs (or if it's just one unidentified type, that's
"some type of virtual machine").

@@ -324,7 +324,7 @@ $ sudo update-initramfs -u
<para>
The simple MTA <systemitem role="package">ssmtp</systemitem>
has been dropped for &releasename;. This is due to it currently
- not validating TLS certs, see <ulink url="&url-bts;662960">bug
+ not validating TLS certs; see <ulink url="&url-bts;662960">bug
#662960</ulink>.
</para>
</listitem>

A piece of punctuation-pedantry I noticed in another section.