From ab2711df3d85aee7fe5c9cbe018c1a08113e3481 Mon Sep 17 00:00:00 2001 From: Antonio Alvarez Feijoo Date: Wed, 23 Nov 2022 14:22:21 +0100 Subject: [PATCH] fix(fips): do not blindly remove /boot The `mount_boot` method called from fips-noboot.sh in the pre-pivot hook blindly executes `rm -rf /boot` if there is no `boot=` command line parameter, without first checking that /boot is not already mounted by other means. feat(fips): add progress messages This allows to better understand at what point a FIPS integrity test failed. Signed-off-by: Raymund Will fix(fips): only unmount /boot if it was mounted by the fips module The `do_fips` method should only unmount /boot if it was mounted in the `mount_boot` method. In addition, now the `mount_boot` method checks if /boot is already mounted. Signed-off-by: Raymund Will fix(fips): move fips-boot script to pre-pivot This is needed in s390x to be able to use the same `boot=` command line parameter in grub and zipl. Otherwise, `boot=` would need to be added only to `grub.cfg` (not `/etc/default/grub` and thereby not to `/boot/zipl/config`). Signed-off-by: Raymund Will (Cherry-picked commits: 91974e8ff116c7fd9f99963780dba501535700f5 a71e518fa1f14a9b96ae62ce90714ccd7d307d97 1cdb4cb8b5fb7f74e5be6998f9b561fbf73909e0 cd2a1d4571b2f768f2b67d03fd77191795042402) Resolves: RHEL-45913 --- modules.d/01fips/fips-boot.sh | 2 ++ modules.d/01fips/fips-load-crypto.sh | 2 ++ modules.d/01fips/fips-noboot.sh | 2 ++ modules.d/01fips/fips.sh | 21 +++++++++++++++++++-- modules.d/01fips/module-setup.sh | 2 +- 5 files changed, 26 insertions(+), 3 deletions(-) diff --git a/modules.d/01fips/fips-boot.sh b/modules.d/01fips/fips-boot.sh index 031d169a..34760e01 100755 --- a/modules.d/01fips/fips-boot.sh +++ b/modules.d/01fips/fips-boot.sh @@ -8,7 +8,9 @@ elif [ -z "$fipsmode" ]; then die "FIPS mode have to be enabled by 'fips=1' not just 'fips'" elif getarg boot= > /dev/null; then . /sbin/fips.sh + fips_info "fips-boot: start" if mount_boot; then do_fips || die "FIPS integrity test failed" fi + fips_info "fips-boot: done!" fi diff --git a/modules.d/01fips/fips-load-crypto.sh b/modules.d/01fips/fips-load-crypto.sh index 21e99278..6ef42b95 100644 --- a/modules.d/01fips/fips-load-crypto.sh +++ b/modules.d/01fips/fips-load-crypto.sh @@ -8,5 +8,7 @@ elif [ -z "$fipsmode" ]; then die "FIPS mode have to be enabled by 'fips=1' not just 'fips'" else . /sbin/fips.sh + fips_info "fips-load-crypto: start" fips_load_crypto || die "FIPS integrity test failed" + fips_info "fips-load-crypto: done!" fi diff --git a/modules.d/01fips/fips-noboot.sh b/modules.d/01fips/fips-noboot.sh index f00c2f32..963a034d 100755 --- a/modules.d/01fips/fips-noboot.sh +++ b/modules.d/01fips/fips-noboot.sh @@ -8,6 +8,8 @@ elif [ -z "$fipsmode" ]; then die "FIPS mode have to be enabled by 'fips=1' not just 'fips'" elif ! [ -f /tmp/fipsdone ]; then . /sbin/fips.sh + fips_info "fips-noboot: start" mount_boot do_fips || die "FIPS integrity test failed" + fips_info "fips-noboot: done!" fi diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh index 6ad61df8..05631c8a 100755 --- a/modules.d/01fips/fips.sh +++ b/modules.d/01fips/fips.sh @@ -18,6 +18,15 @@ mount_boot() { boot=$(getarg boot=) if [ -n "$boot" ]; then + if [ -d /boot ] && ismounted /boot; then + boot_dev= + if command -v findmnt > /dev/null; then + boot_dev=$(findmnt -n -o SOURCE /boot) + fi + fips_info "Ignoring 'boot=$boot' as /boot is already mounted ${boot_dev:+"from '$boot_dev'"}" + return 0 + fi + case "$boot" in LABEL=* | UUID=* | PARTUUID=* | PARTLABEL=*) boot="$(label_uuid_to_dev "$boot")" @@ -47,10 +56,13 @@ mount_boot() { mkdir -p /boot fips_info "Mounting $boot as /boot" mount -oro "$boot" /boot || return 1 - elif [ -d "$NEWROOT/boot" ]; then + FIPS_MOUNTED_BOOT=1 + elif ! ismounted /boot && [ -d "$NEWROOT/boot" ]; then # shellcheck disable=SC2114 rm -fr -- /boot ln -sf "$NEWROOT/boot" /boot + else + die "You have to specify boot= as a boot option for fips=1" fi } @@ -179,7 +191,12 @@ do_fips() { : > /tmp/fipsdone - umount /boot > /dev/null 2>&1 + if [ "$FIPS_MOUNTED_BOOT" = 1 ]; then + fips_info "Unmounting /boot" + umount /boot > /dev/null 2>&1 + else + fips_info "Not unmounting /boot" + fi return 0 } diff --git a/modules.d/01fips/module-setup.sh b/modules.d/01fips/module-setup.sh index 1dc7ea33..91612ff3 100755 --- a/modules.d/01fips/module-setup.sh +++ b/modules.d/01fips/module-setup.sh @@ -62,7 +62,7 @@ installkernel() { # called by dracut install() { - inst_hook pre-mount 01 "$moddir/fips-boot.sh" + inst_hook pre-pivot 00 "$moddir/fips-boot.sh" inst_hook pre-pivot 01 "$moddir/fips-noboot.sh" inst_hook pre-udev 01 "$moddir/fips-load-crypto.sh" inst_script "$moddir/fips.sh" /sbin/fips.sh