cgroup-show: unescape cgroups on presentation

This makes two major changes to the way systemd-random-seed operates:

1. We now optionally credit entropy if this is configured (via an env
var). Previously we never would do that, with this change we still don't
by default, but it's possible to enable this if people acknowledge that
they shouldn't replicate an image with a contained random seed to
multiple systems. Note that in this patch crediting entropy is a boolean
thing (unlike in previous attempts such as systemd#1062), where only a relative
amount of bits was credited. The simpler scheme implemented here should
be OK though as the random seeds saved to disk are now written only with
data from the kernel's entropy pool retrieved after the pool is fully
initialized. Specifically:

2. This makes systemd-random-seed.service a synchronization point for
kernel entropy pool initialization. It was already used like this, for
example by systemd-cryptsetup-generator's /dev/urandom passphrase
handling, with this change it explicitly operates like that (at least
systems which provide getrandom(), where we can support this). This
means early boot services that rely on an initialized random pool should
now place After=systemd-random-seed.service and everything should be
fine. Note that with this change sysinit.target (and thus early boot) is
systematically delayed until the entropy pool is initialized. I'd argue
that's a good thing, and is what we want, if this turns out to be
problematic IRL we might want to drop the Before=sysinit.target line
from the systemd-random-seed.service, which would drop the requirement
that the entropy pool is initialized before regular services are
started, and would mean that regular services using /dev/urandom would
have to be individually ordered against systemd-random-seed.service.

Fixes: systemd#4271
Replaces systemd#10621 systemd#4513

This makes two major changes to the way systemd-random-seed operates:

1. We now optionally credit entropy if this is configured (via an env
var). Previously we never would do that, with this change we still don't
by default, but it's possible to enable this if people acknowledge that
they shouldn't replicate an image with a contained random seed to
multiple systems. Note that in this patch crediting entropy is a boolean
thing (unlike in previous attempts such as systemd#1062), where only a relative
amount of bits was credited. The simpler scheme implemented here should
be OK though as the random seeds saved to disk are now written only with
data from the kernel's entropy pool retrieved after the pool is fully
initialized. Specifically:

2. This makes systemd-random-seed.service a synchronization point for
kernel entropy pool initialization. It was already used like this, for
example by systemd-cryptsetup-generator's /dev/urandom passphrase
handling, with this change it explicitly operates like that (at least
systems which provide getrandom(), where we can support this). This
means early boot services that rely on an initialized random pool should
now place After=systemd-random-seed.service and everything should be
fine. Note that with this change sysinit.target (and thus early boot) is
systematically delayed until the entropy pool is initialized. I'd argue
that's a good thing, and is what we want, if this turns out to be
problematic IRL we might want to drop the Before=sysinit.target line
from the systemd-random-seed.service, which would drop the requirement
that the entropy pool is initialized before regular services are
started, and would mean that regular services using /dev/urandom would
have to be individually ordered against systemd-random-seed.service.

Fixes: systemd#4271
Replaces systemd#10621 systemd#4513

This makes two major changes to the way systemd-random-seed operates:

1. We now optionally credit entropy if this is configured (via an env
var). Previously we never would do that, with this change we still don't
by default, but it's possible to enable this if people acknowledge that
they shouldn't replicate an image with a contained random seed to
multiple systems. Note that in this patch crediting entropy is a boolean
thing (unlike in previous attempts such as systemd#1062), where only a relative
amount of bits was credited. The simpler scheme implemented here should
be OK though as the random seeds saved to disk are now written only with
data from the kernel's entropy pool retrieved after the pool is fully
initialized. Specifically:

2. This makes systemd-random-seed.service a synchronization point for
kernel entropy pool initialization. It was already used like this, for
example by systemd-cryptsetup-generator's /dev/urandom passphrase
handling, with this change it explicitly operates like that (at least
systems which provide getrandom(), where we can support this). This
means early boot services that rely on an initialized random pool should
now place After=systemd-random-seed.service and everything should be
fine. Note that with this change sysinit.target (and thus early boot) is
systematically delayed until the entropy pool is initialized. I'd argue
that's a good thing, and is what we want, if this turns out to be
problematic IRL we might want to drop the Before=sysinit.target line
from the systemd-random-seed.service, which would drop the requirement
that the entropy pool is initialized before regular services are
started, and would mean that regular services using /dev/urandom would
have to be individually ordered against systemd-random-seed.service.

Fixes: systemd#4271
Replaces systemd#10621 systemd#4513

This makes two major changes to the way systemd-random-seed operates:

1. We now optionally credit entropy if this is configured (via an env
var). Previously we never would do that, with this change we still don't
by default, but it's possible to enable this if people acknowledge that
they shouldn't replicate an image with a contained random seed to
multiple systems. Note that in this patch crediting entropy is a boolean
thing (unlike in previous attempts such as systemd#1062), where only a relative
amount of bits was credited. The simpler scheme implemented here should
be OK though as the random seeds saved to disk are now written only with
data from the kernel's entropy pool retrieved after the pool is fully
initialized. Specifically:

2. This makes systemd-random-seed.service a synchronization point for
kernel entropy pool initialization. It was already used like this, for
example by systemd-cryptsetup-generator's /dev/urandom passphrase
handling, with this change it explicitly operates like that (at least
systems which provide getrandom(), where we can support this). This
means early boot services that rely on an initialized random pool should
now place After=systemd-random-seed.service and everything should be
fine. Note that with this change sysinit.target (and thus early boot) is
systematically delayed until the entropy pool is initialized. I'd argue
that's a good thing, and is what we want, if this turns out to be
problematic IRL we might want to drop the Before=sysinit.target line
from the systemd-random-seed.service, which would drop the requirement
that the entropy pool is initialized before regular services are
started, and would mean that regular services using /dev/urandom would
have to be individually ordered against systemd-random-seed.service.

Fixes: systemd#4271
Replaces systemd#10621 systemd#4513

This makes two major changes to the way systemd-random-seed operates:

1. We now optionally credit entropy if this is configured (via an env
var). Previously we never would do that, with this change we still don't
by default, but it's possible to enable this if people acknowledge that
they shouldn't replicate an image with a contained random seed to
multiple systems. Note that in this patch crediting entropy is a boolean
thing (unlike in previous attempts such as systemd#1062), where only a relative
amount of bits was credited. The simpler scheme implemented here should
be OK though as the random seeds saved to disk are now written only with
data from the kernel's entropy pool retrieved after the pool is fully
initialized. Specifically:

2. This makes systemd-random-seed.service a synchronization point for
kernel entropy pool initialization. It was already used like this, for
example by systemd-cryptsetup-generator's /dev/urandom passphrase
handling, with this change it explicitly operates like that (at least
systems which provide getrandom(), where we can support this). This
means early boot services that rely on an initialized random pool should
now place After=systemd-random-seed.service and everything should be
fine. Note that with this change sysinit.target (and thus early boot) is
systematically delayed until the entropy pool is initialized. I'd argue
that's a good thing, and is what we want, if this turns out to be
problematic IRL we might want to drop the Before=sysinit.target line
from the systemd-random-seed.service, which would drop the requirement
that the entropy pool is initialized before regular services are
started, and would mean that regular services using /dev/urandom would
have to be individually ordered against systemd-random-seed.service.

Fixes: systemd#4271
Replaces systemd#10621 systemd#4513

This makes two major changes to the way systemd-random-seed operates:

1. We now optionally credit entropy if this is configured (via an env
var). Previously we never would do that, with this change we still don't
by default, but it's possible to enable this if people acknowledge that
they shouldn't replicate an image with a contained random seed to
multiple systems. Note that in this patch crediting entropy is a boolean
thing (unlike in previous attempts such as systemd#1062), where only a relative
amount of bits was credited. The simpler scheme implemented here should
be OK though as the random seeds saved to disk are now written only with
data from the kernel's entropy pool retrieved after the pool is fully
initialized. Specifically:

2. This makes systemd-random-seed.service a synchronization point for
kernel entropy pool initialization. It was already used like this, for
example by systemd-cryptsetup-generator's /dev/urandom passphrase
handling, with this change it explicitly operates like that (at least
systems which provide getrandom(), where we can support this). This
means early boot services that rely on an initialized random pool should
now place After=systemd-random-seed.service and everything should be
fine. Note that with this change sysinit.target (and thus early boot) is
systematically delayed until the entropy pool is initialized. I'd argue
that's a good thing, and is what we want, if this turns out to be
problematic IRL we might want to drop the Before=sysinit.target line
from the systemd-random-seed.service, which would drop the requirement
that the entropy pool is initialized before regular services are
started, and would mean that regular services using /dev/urandom would
have to be individually ordered against systemd-random-seed.service.

Fixes: systemd#4271
Replaces systemd#10621 systemd#4513

This makes two major changes to the way systemd-random-seed operates:

1. We now optionally credit entropy if this is configured (via an env
var). Previously we never would do that, with this change we still don't
by default, but it's possible to enable this if people acknowledge that
they shouldn't replicate an image with a contained random seed to
multiple systems. Note that in this patch crediting entropy is a boolean
thing (unlike in previous attempts such as systemd#1062), where only a relative
amount of bits was credited. The simpler scheme implemented here should
be OK though as the random seeds saved to disk are now written only with
data from the kernel's entropy pool retrieved after the pool is fully
initialized. Specifically:

2. This makes systemd-random-seed.service a synchronization point for
kernel entropy pool initialization. It was already used like this, for
example by systemd-cryptsetup-generator's /dev/urandom passphrase
handling, with this change it explicitly operates like that (at least
systems which provide getrandom(), where we can support this). This
means early boot services that rely on an initialized random pool should
now place After=systemd-random-seed.service and everything should be
fine. Note that with this change sysinit.target (and thus early boot) is
systematically delayed until the entropy pool is initialized. I'd argue
that's a good thing, and is what we want, if this turns out to be
problematic IRL we might want to drop the Before=sysinit.target line
from the systemd-random-seed.service, which would drop the requirement
that the entropy pool is initialized before regular services are
started, and would mean that regular services using /dev/urandom would
have to be individually ordered against systemd-random-seed.service.

Fixes: systemd#4271
Replaces systemd#10621 systemd#4513

This makes two major changes to the way systemd-random-seed operates:

1. We now optionally credit entropy if this is configured (via an env
var). Previously we never would do that, with this change we still don't
by default, but it's possible to enable this if people acknowledge that
they shouldn't replicate an image with a contained random seed to
multiple systems. Note that in this patch crediting entropy is a boolean
thing (unlike in previous attempts such as systemd#1062), where only a relative
amount of bits was credited. The simpler scheme implemented here should
be OK though as the random seeds saved to disk are now written only with
data from the kernel's entropy pool retrieved after the pool is fully
initialized. Specifically:

2. This makes systemd-random-seed.service a synchronization point for
kernel entropy pool initialization. It was already used like this, for
example by systemd-cryptsetup-generator's /dev/urandom passphrase
handling, with this change it explicitly operates like that (at least
systems which provide getrandom(), where we can support this). This
means early boot services that rely on an initialized random pool should
now place After=systemd-random-seed.service and everything should be
fine. Note that with this change sysinit.target (and thus early boot) is
systematically delayed until the entropy pool is initialized. I'd argue
that's a good thing, and is what we want, if this turns out to be
problematic IRL we might want to drop the Before=sysinit.target line
from the systemd-random-seed.service, which would drop the requirement
that the entropy pool is initialized before regular services are
started, and would mean that regular services using /dev/urandom would
have to be individually ordered against systemd-random-seed.service.

Fixes: systemd#4271
Replaces: systemd#10621 systemd#4513

This makes two major changes to the way systemd-random-seed operates:

1. We now optionally credit entropy if this is configured (via an env
var). Previously we never would do that, with this change we still don't
by default, but it's possible to enable this if people acknowledge that
they shouldn't replicate an image with a contained random seed to
multiple systems. Note that in this patch crediting entropy is a boolean
thing (unlike in previous attempts such as systemd#1062), where only a relative
amount of bits was credited. The simpler scheme implemented here should
be OK though as the random seeds saved to disk are now written only with
data from the kernel's entropy pool retrieved after the pool is fully
initialized. Specifically:

2. This makes systemd-random-seed.service a synchronization point for
kernel entropy pool initialization. It was already used like this, for
example by systemd-cryptsetup-generator's /dev/urandom passphrase
handling, with this change it explicitly operates like that (at least
systems which provide getrandom(), where we can support this). This
means services that rely on an initialized random pool should now place
After=systemd-random-seed.service and everything should be fine. Note
that with this change sysinit.target (and thus early boot) is NOT
systematically delayed until the entropy pool is initialized, i.e.
regular services need to add explicit ordering deps on this service if
they require an initialized random pool.

Fixes: systemd#4271
Replaces: systemd#10621 systemd#4513