fips: handle checksum checks for RHEV kernels
https://bugzilla.redhat.com/show_bug.cgi?id=947729master
parent
748867d177
commit
190047f161
|
@ -55,6 +55,22 @@ mount_boot()
|
|||
fi
|
||||
}
|
||||
|
||||
do_rhevh_check()
|
||||
{
|
||||
KERNEL=$(uname -r)
|
||||
kpath=${1}
|
||||
|
||||
# If we're on RHEV-H, the kernel is in /dev/.initramfs/live/vmlinuz0
|
||||
HMAC_SUM_ORIG=$(cat /boot/.vmlinuz-${KERNEL}.hmac | while read a b; do printf "%s\n" $a; done)
|
||||
HMAC_SUM_CALC=$(sha512hmac $kpath | while read a b; do printf "%s\n" $a; done || return 1)
|
||||
if [ -z "$HMAC_SUM_ORIG" ] || [ -z "$HMAC_SUM_CALC" ] || [ "${HMAC_SUM_ORIG}" != "${HMAC_SUM_CALC}" ]; then
|
||||
warn "HMAC sum mismatch"
|
||||
return 1
|
||||
fi
|
||||
info "rhevh_check OK"
|
||||
return 0
|
||||
}
|
||||
|
||||
do_fips()
|
||||
{
|
||||
local _v
|
||||
|
@ -96,7 +112,13 @@ do_fips()
|
|||
rmmod tcrypt
|
||||
|
||||
info "Checking integrity of kernel"
|
||||
sha512hmac -c "/boot/.vmlinuz-${KERNEL}.hmac" || return 1
|
||||
if [ -e "$NEWROOT/dev/.initramfs/live/vmlinuz0" ]; then
|
||||
do_rhevh_check "$NEWROOT/dev/.initramfs/live/vmlinuz0" || return 1
|
||||
elif [ -e "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" ]; then
|
||||
do_rhevh_check "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" || return 1
|
||||
else
|
||||
sha512hmac -c "/boot/.vmlinuz-${KERNEL}.hmac" || return 1
|
||||
fi
|
||||
|
||||
info "All initrd crypto checks done"
|
||||
|
||||
|
|
Loading…
Reference in New Issue