87 lines
2.4 KiB
Diff
87 lines
2.4 KiB
Diff
|
From 9c54932f590fd7accadc780c6ee946a94286b7e6 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Lukas Nykryn <lnykryn@redhat.com>
|
||
|
|
Date: Tue, 14 May 2019 09:23:55 +0200
|
||
|
|
Subject: [PATCH] fips: split loading the crypto modules and checking the
|
||
|
|
kernel
|
||
|
|
|
||
|
|
In e54ab383 we moved the fips script to a later pahse of boot, since
|
||
|
|
the /boot might not be available early on.
|
||
|
|
|
||
|
|
The problem is that systemd-cryptsetup* services could be run now
|
||
|
|
started before the do_fips is executed and need the crypto modules
|
||
|
|
to decrypted the devices.
|
||
|
|
|
||
|
|
So let's split the do_fips and load the module before udev does the
|
||
|
|
trigger.
|
||
|
|
---
|
||
|
|
modules.d/01fips/fips-load-crypto.sh | 8 ++++++++
|
||
|
|
modules.d/01fips/fips.sh | 19 +++++++++++--------
|
||
|
|
modules.d/01fips/module-setup.sh | 1 +
|
||
|
|
3 files changed, 20 insertions(+), 8 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/modules.d/01fips/fips-load-crypto.sh b/modules.d/01fips/fips-load-crypto.sh
|
||
|
|
new file mode 100644
|
||
|
|
index 00000000..82cbeee4
|
||
|
|
--- /dev/null
|
||
|
|
+++ b/modules.d/01fips/fips-load-crypto.sh
|
||
|
|
@@ -0,0 +1,8 @@
|
||
|
|
+#!/bin/sh
|
||
|
|
+
|
||
|
|
+if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then
|
||
|
|
+ rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1
|
||
|
|
+else
|
||
|
|
+ . /sbin/fips.sh
|
||
|
|
+ fips_load_crypto || die "FIPS integrity test failed"
|
||
|
|
+fi
|
||
|
|
diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
|
||
|
|
index 9bc089f2..beaa692b 100755
|
||
|
|
--- a/modules.d/01fips/fips.sh
|
||
|
|
+++ b/modules.d/01fips/fips.sh
|
||
|
|
@@ -69,15 +69,8 @@ do_rhevh_check()
|
||
|
|
return 0
|
||
|
|
}
|
||
|
|
|
||
|
|
-do_fips()
|
||
|
|
+fips_load_crypto()
|
||
|
|
{
|
||
|
|
- local _v
|
||
|
|
- local _s
|
||
|
|
- local _v
|
||
|
|
- local _module
|
||
|
|
-
|
||
|
|
- KERNEL=$(uname -r)
|
||
|
|
-
|
||
|
|
FIPSMODULES=$(cat /etc/fipsmodules)
|
||
|
|
|
||
|
|
info "Loading and integrity checking all crypto modules"
|
||
|
|
@@ -102,6 +95,16 @@ do_fips()
|
||
|
|
info "Self testing crypto algorithms"
|
||
|
|
modprobe tcrypt || return 1
|
||
|
|
rmmod tcrypt
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
+do_fips()
|
||
|
|
+{
|
||
|
|
+ local _v
|
||
|
|
+ local _s
|
||
|
|
+ local _v
|
||
|
|
+ local _module
|
||
|
|
+
|
||
|
|
+ KERNEL=$(uname -r)
|
||
|
|
|
||
|
|
info "Checking integrity of kernel"
|
||
|
|
if [ -e "/run/initramfs/live/vmlinuz0" ]; then
|
||
|
|
diff --git a/modules.d/01fips/module-setup.sh b/modules.d/01fips/module-setup.sh
|
||
|
|
index f3af4d90..18186d62 100755
|
||
|
|
--- a/modules.d/01fips/module-setup.sh
|
||
|
|
+++ b/modules.d/01fips/module-setup.sh
|
||
|
|
@@ -54,6 +54,7 @@ install() {
|
||
|
|
local _dir
|
||
|
|
inst_hook pre-trigger 01 "$moddir/fips-boot.sh"
|
||
|
|
inst_hook pre-pivot 01 "$moddir/fips-noboot.sh"
|
||
|
|
+ inst_hook pre-udev 01 "$moddir/fips-load-crypto.sh"
|
||
|
|
inst_script "$moddir/fips.sh" /sbin/fips.sh
|
||
|
|
|
||
|
|
inst_multiple sha512hmac rmmod insmod mount uname umount
|
||
|
|
|