/dev/random and /dev/urandom are world-writeable by design. This allows anyone to contribute to randomness via "cat ~/my_secrets > /dev/random". Of course, m

/dev/random and /dev/urandom are world-writeable by design. This allows anyone to contribute to randomness via "cat ~/my_secrets > /dev/random". Of course, my_secrets might not be very secret, or controlled by the attacker. So there is no credit given to that. There is a way for a root process, like systemd, to contribute trusted entropy to the entropy pool, using an ioctl. Of course, then it is systemd which will be taking on the responsibility if it turns out that /var/lib/random_seed turns out to be replicated onto a zillion static images on some IOT device, so it turns out /var/lib/random_seed wasn't actually all that random to begin with