You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
63 lines
2.5 KiB
63 lines
2.5 KiB
From 69a889ee675822102d04e99a25bdc92aa977263a Mon Sep 17 00:00:00 2001 |
|
From: Lukas Nykryn <lnykryn@redhat.com> |
|
Date: Tue, 26 Dec 2017 12:18:47 +0100 |
|
Subject: [PATCH] 01fips: Properly fix creating path to .hmac of kernel based |
|
on BOOT_IMAGE |
|
|
|
8f5c5 broke the case where BOOT_IMAGE is not set at all. |
|
This code should handle following: |
|
1) BOOT_IMAGE not set |
|
2) BOOT_IMAGE set to something unrelated (s390) |
|
3) BOOT_IMAGE=vmlinuz-4.14.7-300.fc27.x86_64 |
|
4) BOOT_IMAGE=/vmlinuz-4.14.7-300.fc27.x86_64 |
|
5) BOOT_IMAGE=/boot/vmlinuz-4.14.7-300.fc27.x86_64 |
|
6) BOOT_IMAGE=subdir/vmlinuz-4.14.7-300.fc27.x86_64 |
|
7) BOOT_IMAGE=/subdir/vmlinuz-4.14.7-300.fc27.x86_64 |
|
8) BOOT_IMAGE=/boot/subdir/vmlinuz-4.14.7-300.fc27.x86_64 |
|
|
|
https://bugzilla.redhat.com/show_bug.cgi?id=1415032 |
|
|
|
Cherry-picked from: d818986db485fc57a76a247a8475c3144acd33dc |
|
Resolves: #1415032 |
|
--- |
|
modules.d/01fips/fips.sh | 20 +++++++++++++++----- |
|
1 file changed, 15 insertions(+), 5 deletions(-) |
|
|
|
diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh |
|
index 6c5dd60f..c72c1273 100755 |
|
--- a/modules.d/01fips/fips.sh |
|
+++ b/modules.d/01fips/fips.sh |
|
@@ -112,18 +112,28 @@ do_fips() |
|
do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1 |
|
else |
|
BOOT_IMAGE="$(getarg BOOT_IMAGE)" |
|
- if ! [ -e "/boot/${BOOT_IMAGE}" ]; then |
|
+ BOOT_IMAGE_NAME="${BOOT_IMAGE##*/}" |
|
+ BOOT_IMAGE_PATH="${BOOT_IMAGE%${BOOT_IMAGE_NAME}}" |
|
+ |
|
+ if [ -z "$BOOT_IMAGE_NAME" ]; then |
|
+ BOOT_IMAGE_NAME="vmlinuz-${KERNEL}" |
|
+ elif ! [ -e "/boot/${BOOT_IMAGE_PATH}/${BOOT_IMAGE}" ]; then |
|
#if /boot is not a separate partition BOOT_IMAGE might start with /boot |
|
- BOOT_IMAGE=${BOOT_IMAGE#"/boot"} |
|
- [ -e "/boot/${BOOT_IMAGE}" ] || BOOT_IMAGE="vmlinuz-${KERNEL}" |
|
+ BOOT_IMAGE_PATH=${BOOT_IMAGE_PATH#"/boot"} |
|
+ #on some achitectures BOOT_IMAGE does not contain path to kernel |
|
+ #so if we can't find anything, let's treat it in the same way as if it was empty |
|
+ if ! [ -e "/boot/${BOOT_IMAGE_PATH}/${BOOT_IMAGE_NAME}" ]; then |
|
+ BOOT_IMAGE_NAME="vmlinuz-${KERNEL}" |
|
+ BOOT_IMAGE_PATH="" |
|
+ fi |
|
fi |
|
- |
|
- BOOT_IMAGE_HMAC="/boot/${BOOT_IMAGE%/*}/.${BOOT_IMAGE##*/}.hmac" |
|
|
|
+ BOOT_IMAGE_HMAC="/boot/${BOOT_IMAGE_PATH}.${BOOT_IMAGE_NAME}.hmac" |
|
if ! [ -e "${BOOT_IMAGE_HMAC}" ]; then |
|
warn "${BOOT_IMAGE_HMAC} does not exist" |
|
return 1 |
|
fi |
|
+ |
|
sha512hmac -c "${BOOT_IMAGE_HMAC}" || return 1 |
|
fi |
|
|
|
|