You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
49 lines
1.9 KiB
49 lines
1.9 KiB
From 9b1d79993dbed054c5069f97204280a39ed61219 Mon Sep 17 00:00:00 2001 |
|
From: Lukas Nykryn <lnykryn@redhat.com> |
|
Date: Mon, 18 Dec 2017 14:48:59 +0100 |
|
Subject: [PATCH] 01fips: Fix creating path to .hmac of kernel based on |
|
BOOT_IMAGE |
|
|
|
Old code did not work for two most common use-cases. |
|
On most machines BOOT_IMAGE is set to something like |
|
/vmlinuz-4.11.3-202.fc25.x86_64. So if we just add prefix "/boot/." |
|
it won't work. Also on machines without /boot on separate partition |
|
BOOT_IMAGE already has the /boot/ prefix (/boot/vmlinuz-3.10.0-799.el7.x86_64). |
|
So let's strip it in such case. |
|
|
|
https://bugzilla.redhat.com/show_bug.cgi?id=1415032 |
|
|
|
Cherry-picked from: 8f5c564cb30966878b0d90025568253016e1402f |
|
Resolves: #1415032 |
|
--- |
|
modules.d/01fips/fips.sh | 14 ++++++++++---- |
|
1 file changed, 10 insertions(+), 4 deletions(-) |
|
|
|
diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh |
|
index ecd711c2..6c5dd60f 100755 |
|
--- a/modules.d/01fips/fips.sh |
|
+++ b/modules.d/01fips/fips.sh |
|
@@ -112,13 +112,19 @@ do_fips() |
|
do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1 |
|
else |
|
BOOT_IMAGE="$(getarg BOOT_IMAGE)" |
|
- [ -e "/boot/.${BOOT_IMAGE}.hmac" ] || BOOT_IMAGE="vmlinuz-${KERNEL}" |
|
+ if ! [ -e "/boot/${BOOT_IMAGE}" ]; then |
|
+ #if /boot is not a separate partition BOOT_IMAGE might start with /boot |
|
+ BOOT_IMAGE=${BOOT_IMAGE#"/boot"} |
|
+ [ -e "/boot/${BOOT_IMAGE}" ] || BOOT_IMAGE="vmlinuz-${KERNEL}" |
|
+ fi |
|
+ |
|
+ BOOT_IMAGE_HMAC="/boot/${BOOT_IMAGE%/*}/.${BOOT_IMAGE##*/}.hmac" |
|
|
|
- if ! [ -e "/boot/.${BOOT_IMAGE}.hmac" ]; then |
|
- warn "/boot/.${BOOT_IMAGE}.hmac does not exist" |
|
+ if ! [ -e "${BOOT_IMAGE_HMAC}" ]; then |
|
+ warn "${BOOT_IMAGE_HMAC} does not exist" |
|
return 1 |
|
fi |
|
- sha512hmac -c "/boot/.${BOOT_IMAGE}.hmac" || return 1 |
|
+ sha512hmac -c "${BOOT_IMAGE_HMAC}" || return 1 |
|
fi |
|
|
|
info "All initrd crypto checks done"
|
|
|