echo "Initializing random number generator..."
random_seed=/var/run/random-seed
if [ -f $random_seed ]; then
        cat $random_seed >/dev/urandom
else
        touch $random_seed
fi
chmod 600 $random_seed
dd if=/dev/urandom of=$random_seed count=1 bs=512

echo "Saving random seed..."
random_seed=/var/run/random-seed
touch $random_seed
chmod 600 $random_seed
dd if=/dev/urandom of=$random_seed count=1 bs=512

systemctl cat systemd-random-seed.service 

[Unit]
Description=Load/Save Random Seed
Documentation=man:systemd-random-seed.service(8) man:random(4)
DefaultDependencies=no
RequiresMountsFor=/var/lib/systemd/random-seed
Conflicts=shutdown.target
After=systemd-remount-fs.service
Before=shutdown.target
ConditionVirtualization=!container

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/lib/systemd/systemd-random-seed load
ExecStop=/lib/systemd/systemd-random-seed save
TimeoutSec=10min

#!/bin/sh
#
#

# PROVIDE: random
# REQUIRE: FILESYSTEMS
# BEFORE: netif
# KEYWORD: nojail shutdown

. /etc/rc.subr

name="random"
desc="Harvest and save entropy for random device"
start_cmd="random_start"
stop_cmd="random_stop"

extra_commands="saveseed"
saveseed_cmd="${name}_stop"

save_dev_random()
{
	oumask=`umask`
	umask 077
	for f ; do
		debug "saving entropy to $f"
		dd if=/dev/random of="$f" bs=4096 count=1 status=none &&
			( chflags nodump "$f" 2>/dev/null || : ) &&
			chmod 600 "$f" &&
			fsync "$f" "$(dirname "$f")"
	done
	umask ${oumask}
}

feed_dev_random()
{
	for f ; do
		if [ -f "$f" -a -r "$f" -a -s "$f" ] ; then
			if dd if="$f" of=/dev/random bs=4096 2>/dev/null ; then
				debug "entropy read from $f"
				rm -f "$f"
			fi
		fi
	done
}

random_start()
{

	if [ -n "${harvest_mask}" ]; then
		echo -n 'Setting up harvesting: '
		${SYSCTL} kern.random.harvest.mask=${harvest_mask} > /dev/null
		${SYSCTL_N} kern.random.harvest.mask_symbolic
	fi

	echo -n 'Feeding entropy: '

	if [ ! -w /dev/random ] ; then
		warn "/dev/random is not writeable"
		return 1
	fi

	# Reseed /dev/random with previously stored entropy.
	case ${entropy_dir:=/var/db/entropy} in
	[Nn][Oo])
		;;
	*)
		if [ -d "${entropy_dir}" ] ; then
			feed_dev_random "${entropy_dir}"/*
		fi
		;;
	esac

	case ${entropy_file:=/entropy} in
	[Nn][Oo])
		;;
	*)
		feed_dev_random "${entropy_file}" /var/db/entropy-file
		save_dev_random "${entropy_file}"
		;;
	esac

	case ${entropy_boot_file:=/boot/entropy} in
	[Nn][Oo])
		;;
	*)
		save_dev_random "${entropy_boot_file}"
		;;
	esac

	echo '.'
}

random_stop()
{
	# Write some entropy so when the machine reboots /dev/random
	# can be reseeded
	#
	case ${entropy_file:=/entropy} in
	[Nn][Oo])
		;;
	*)
		echo -n 'Writing entropy file: '
		rm -f ${entropy_file} 2> /dev/null
		oumask=`umask`
		umask 077
		if touch ${entropy_file} 2> /dev/null; then
			entropy_file_confirmed="${entropy_file}"
		else
			# Try this as a reasonable alternative for read-only
			# roots, diskless workstations, etc.
			rm -f /var/db/entropy-file 2> /dev/null
			if touch /var/db/entropy-file 2> /dev/null; then
				entropy_file_confirmed=/var/db/entropy-file
			fi
		fi
		case ${entropy_file_confirmed} in
		'')
			warn 'write failed (read-only fs?)'
			;;
		*)
			save_dev_random "${entropy_file_confirmed}"
			echo '.'
			;;
		esac
		umask ${oumask}
		;;
	esac
	case ${entropy_boot_file:=/boot/entropy} in
	[Nn][Oo])
		;;
	*)
		echo -n 'Writing early boot entropy file: '
		rm -f ${entropy_boot_file} 2> /dev/null
		oumask=`umask`
		umask 077
		if touch ${entropy_boot_file} 2> /dev/null; then
			entropy_boot_file_confirmed="${entropy_boot_file}"
		fi
		case ${entropy_boot_file_confirmed} in
		'')
			warn 'write failed (read-only fs?)'
			;;
		*)
			save_dev_random "${entropy_boot_file_confirmed}"
			echo '.'
			;;
		esac
		umask ${oumask}
		;;
	esac
}

load_rc_config $name

# doesn't make sense to run in a svcj: config setting
random_svcj="NO"

run_rc_command "$1"

sysctl -a | grep kern |grep random
kern.randompid: 0
kern.random.fortuna.concurrent_read: 1
kern.random.fortuna.minpoolsize: 64
kern.random.rdrand.rdrand_independent_seed: 0
kern.random.use_chacha20_cipher: 1
kern.random.block_seeded_status: 0
kern.random.random_sources: 'Intel Secure Key RNG'
kern.random.harvest.mask_symbolic: PURE_RDRAND,[UMA],[FS_ATIME],SWI,INTERRUPT,NET_NG,[NET_ETHER],NET_TUN,MOUSE,KEYBOARD,ATTACH,CACHED
kern.random.harvest.mask_bin: 000000001000000111011111
kern.random.harvest.mask: 33247
kern.random.initial_seeding.disable_bypass_warnings: 0
kern.random.initial_seeding.arc4random_bypassed_before_seeding: 0
kern.random.initial_seeding.read_random_bypassed_before_seeding: 0
kern.random.initial_seeding.bypass_before_seeding: 1

asmlinkage __visible __init __no_sanitize_address __noreturn __no_stack_protector
void start_kernel(void)
{
	char *command_line;
	char *after_dashes;

	set_task_stack_end_magic(&init_task);
	smp_setup_processor_id();
	debug_objects_early_init();
	init_vmlinux_build_id();

	cgroup_init_early();

	local_irq_disable();
	early_boot_irqs_disabled = true;

	/*
	 * Interrupts are still disabled. Do necessary setups, then
	 * enable them.
	 */
	boot_cpu_init();
	page_address_init();
	pr_notice("%s", linux_banner);
	early_security_init();
	setup_arch(&command_line);
	setup_boot_config();
	setup_command_line(command_line);
	setup_nr_cpu_ids();
	setup_per_cpu_areas();
	smp_prepare_boot_cpu();	/* arch-specific boot-cpu hooks */
	early_numa_node_init();
	boot_cpu_hotplug_init();

	pr_notice("Kernel command line: %s\n", saved_command_line);
	/* parameters may set static keys */
	jump_label_init();
	parse_early_param();
	after_dashes = parse_args("Booting kernel",
				  static_command_line, __start___param,
				  __stop___param - __start___param,
				  -1, -1, NULL, &unknown_bootoption);
	print_unknown_bootoptions();
	if (!IS_ERR_OR_NULL(after_dashes))
		parse_args("Setting init args", after_dashes, NULL, 0, -1, -1,
			   NULL, set_init_arg);
	if (extra_init_args)
		parse_args("Setting extra init args", extra_init_args,
			   NULL, 0, -1, -1, NULL, set_init_arg);

	/* Architectural and non-timekeeping rng init, before allocator init */
	random_init_early(command_line);

	/*
	 * These use large bootmem allocations and must precede
	 * initalization of page allocator
	 */
	setup_log_buf(0);
	vfs_caches_init_early();
	sort_main_extable();
	trap_init();
	mm_core_init();
	poking_init();
	ftrace_init();

	/* trace_printk can be enabled here */
	early_trace_init();

	/*
	 * Set up the scheduler prior starting any interrupts (such as the
	 * timer interrupt). Full topology setup happens at smp_init()
	 * time - but meanwhile we still have a functioning scheduler.
	 */
	sched_init();

	if (WARN(!irqs_disabled(),
		 "Interrupts were enabled *very* early, fixing it\n"))
		local_irq_disable();
	radix_tree_init();
	maple_tree_init();

	/*
	 * Set up housekeeping before setting up workqueues to allow the unbound
	 * workqueue to take non-housekeeping into account.
	 */
	housekeeping_init();

	/*
	 * Allow workqueue creation and work item queueing/cancelling
	 * early.  Work item execution depends on kthreads and starts after
	 * workqueue_init().
	 */
	workqueue_init_early();

	rcu_init();

	/* Trace events are available after this */
	trace_init();

	if (initcall_debug)
		initcall_debug_enable();

	context_tracking_init();
	/* init some links before init_ISA_irqs() */
	early_irq_init();
	init_IRQ();
	tick_init();
	rcu_init_nohz();
	init_timers();
	srcu_init();
	hrtimers_init();
	softirq_init();
	timekeeping_init();
	time_init();

	/* This must be after timekeeping is initialized */
	random_init();

	/* These make use of the fully initialized rng */
	kfence_init();
	boot_init_stack_canary();

	perf_event_init();
	profile_init();
	call_function_init();
	WARN(!irqs_disabled(), "Interrupts were enabled early\n");

	early_boot_irqs_disabled = false;
	local_irq_enable();

	kmem_cache_init_late();

	/*
	 * HACK ALERT! This is early. We're enabling the console before
	 * we've done PCI setups etc, and console_init() must be aware of
	 * this. But we do want output early, in case something goes wrong.
	 */
	console_init();
	if (panic_later)
		panic("Too many boot %s vars at `%s'", panic_later,
		      panic_param);

	lockdep_init();

	/*
	 * Need to run this when irqs are enabled, because it wants
	 * to self-test [hard/soft]-irqs on/off lock inversion bugs
	 * too:
	 */
	locking_selftest();

#ifdef CONFIG_BLK_DEV_INITRD
	if (initrd_start && !initrd_below_start_ok &&
	    page_to_pfn(virt_to_page((void *)initrd_start)) < min_low_pfn) {
		pr_crit("initrd overwritten (0x%08lx < 0x%08lx) - disabling it.\n",
		    page_to_pfn(virt_to_page((void *)initrd_start)),
		    min_low_pfn);
		initrd_start = 0;
	}
#endif
	setup_per_cpu_pageset();
	numa_policy_init();
	acpi_early_init();
	if (late_time_init)
		late_time_init();
	sched_clock_init();
	calibrate_delay();

	arch_cpu_finalize_init();

	pid_idr_init();
	anon_vma_init();
#ifdef CONFIG_X86
	if (efi_enabled(EFI_RUNTIME_SERVICES))
		efi_enter_virtual_mode();
#endif
	thread_stack_cache_init();
	cred_init();
	fork_init();
	proc_caches_init();
	uts_ns_init();
	key_init();
	security_init();
	dbg_late_init();
	net_ns_init();
	vfs_caches_init();
	pagecache_init();
	signals_init();
	seq_file_init();
	proc_root_init();
	nsfs_init();
	pidfs_init();
	cpuset_init();
	cgroup_init();
	taskstats_init_early();
	delayacct_init();

	acpi_subsystem_init();
	arch_post_acpi_subsys_init();
	kcsan_init();

	/* Do the rest non-__init'ed, we're now alive */
	rest_init();

	/*
	 * Avoid stack canaries in callers of boot_init_stack_canary for gcc-10
	 * and older.
	 */
#if !__has_attribute(__no_stack_protector__)
	prevent_tail_call_optimization();
#endif
}