1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
#!/bin/sh
# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
# ex: ts=8 sw=4 sts=4 et filetype=sh
mount_boot()
{
boot=$(getarg boot=)
if [ -n "$boot" ]; then
case "$boot" in
LABEL=*)
boot="$(echo $boot | sed 's,/,\\x2f,g')"
boot="/dev/disk/by-label/${boot#LABEL=}"
;;
UUID=*)
boot="/dev/disk/by-uuid/${boot#UUID=}"
;;
/dev/*)
;;
*)
die "You have to specify boot=<boot device> as a boot option for fips=1" ;;
esac
if ! [ -e "$boot" ]; then
udevadm trigger --action=add >/dev/null 2>&1
[ -z "$UDEVVERSION" ] && UDEVVERSION=$(udevadm --version)
i=0
while ! [ -e $boot ]; do
if [ $UDEVVERSION -ge 143 ]; then
udevadm settle --exit-if-exists=$boot
else
udevadm settle --timeout=30
fi
[ -e $boot ] && break
modprobe scsi_wait_scan && rmmod scsi_wait_scan
[ -e $boot ] && break
sleep 0.5
i=$(($i+1))
[ $i -gt 40 ] && break
done
fi
[ -e "$boot" ] || return 1
mkdir /boot
info "Mounting $boot as /boot"
mount -oro "$boot" /boot || return 1
fi
}
do_fips()
{
info "Checking integrity of kernel"
newroot=$NEWROOT
KERNEL=$(uname -r)
[ -e "$newroot/boot/.vmlinuz-${KERNEL}.hmac" ] || unset newroot
if ! [ -e "$newroot/boot/.vmlinuz-${KERNEL}.hmac" ]; then
warn "$newroot/boot/.vmlinuz-${KERNEL}.hmac does not exist"
return 1
fi
sha512hmac -c "$newroot/boot/.vmlinuz-${KERNEL}.hmac" || return 1
FIPSMODULES=$(cat /etc/fipsmodules)
info "Loading and integrity checking all crypto modules"
for module in $FIPSMODULES; do
if [ "$module" != "tcrypt" ]; then
modprobe ${module} || return 1
fi
done
info "Self testing crypto algorithms"
modprobe tcrypt || return 1
rmmod tcrypt
info "All initrd crypto checks done"
> /tmp/fipsdone
umount /boot >/dev/null 2>&1
return 0
}
|
