diff --git a/files/build_templates/sonic_debian_extension.j2 b/files/build_templates/sonic_debian_extension.j2 index 29a7eb2dca..4d4f4b37bc 100644 --- a/files/build_templates/sonic_debian_extension.j2 +++ b/files/build_templates/sonic_debian_extension.j2 @@ -352,6 +352,10 @@ sudo mkdir -p $FILESYSTEM_ROOT/etc/systemd/system/syslog.socket.d sudo cp $IMAGE_CONFIGS/syslog/override.conf $FILESYSTEM_ROOT/etc/systemd/system/syslog.socket.d/override.conf sudo cp $IMAGE_CONFIGS/syslog/host_umount.sh $FILESYSTEM_ROOT/usr/bin/ +# Copy haveged override file +sudo mkdir -p $FILESYSTEM_ROOT/etc/systemd/system/ +sudo cp $IMAGE_CONFIGS/haveged/haveged.service $FILESYSTEM_ROOT_ETC/systemd/system/haveged.service + # Copy system-health files sudo LANG=C cp $IMAGE_CONFIGS/system-health/system-health.service $FILESYSTEM_ROOT_USR_LIB_SYSTEMD_SYSTEM echo "system-health.service" | sudo tee -a $GENERATED_SERVICE_FILE diff --git a/files/image_config/haveged/haveged.service b/files/image_config/haveged/haveged.service new file mode 100644 index 0000000000..361b1114b1 --- /dev/null +++ b/files/image_config/haveged/haveged.service @@ -0,0 +1,23 @@ +[Unit] +Description=Entropy daemon using the HAVEGE algorithm +Documentation=man:haveged(8) http://www.issihosts.com/haveged/ +DefaultDependencies=no +ConditionVirtualization=!container +After=apparmor.service systemd-tmpfiles-setup.service +Before=sysinit.target shutdown.target systemd-random-seed.service + +[Service] +EnvironmentFile=-/etc/default/haveged +ExecStart=/usr/sbin/haveged --Foreground --verbose=1 $DAEMON_ARGS +SuccessExitStatus=143 +SecureBits=noroot-locked +NoNewPrivileges=yes +CapabilityBoundingSet=CAP_SYS_ADMIN +PrivateTmp=yes +PrivateDevices=yes +PrivateNetwork=yes +ProtectSystem=full +ProtectHome=yes + +[Install] +WantedBy=default.target