1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
#!/bin/bash
# called by dracut
check() {
return 255
}
# called by dracut
depends() {
return 0
}
# called by dracut
installkernel() {
local _fipsmodules _mod
if [[ -f "${srcmods}/modules.fips" ]]; then
_fipsmodules="$(cat "${srcmods}/modules.fips")"
else
_fipsmodules=""
# Hashes:
_fipsmodules+="sha1 sha224 sha256 sha384 sha512 "
_fipsmodules+="sha3-224 sha3-256 sha3-384 sha3-512 "
_fipsmodules+="crc32c crct10dif ghash "
# Ciphers:
_fipsmodules+="cipher_null des3_ede aes "
# Modes/templates:
_fipsmodules+="ecb cbc ctr xts gcm ccm authenc hmac cmac "
# Compression algs:
_fipsmodules+="deflate lzo zlib "
# PRNG algs:
_fipsmodules+="ansi_cprng "
# Misc:
_fipsmodules+="aead cryptomgr tcrypt crypto_user "
fi
mkdir -m 0755 -p "${initdir}/etc/modprobe.d"
for _mod in $_fipsmodules; do
if hostonly='' instmods -c -s $_mod; then
echo $_mod >> "${initdir}/etc/fipsmodules"
echo "blacklist $_mod" >> "${initdir}/etc/modprobe.d/fips.conf"
fi
done
}
# called by dracut
install() {
local _dir
inst_hook pre-trigger 01 "$moddir/fips-boot.sh"
inst_hook pre-pivot 01 "$moddir/fips-noboot.sh"
inst_script "$moddir/fips.sh" /sbin/fips.sh
inst_multiple sha512hmac rmmod insmod mount uname umount
inst_simple /etc/system-fips
[ -c ${initdir}/dev/random ] || mknod ${initdir}/dev/random c 1 8 \
|| {
dfatal "Cannot create /dev/random"
dfatal "To create an initramfs with fips support, dracut has to run as root"
return 1
}
[ -c ${initdir}/dev/urandom ] || mknod ${initdir}/dev/urandom c 1 9 \
|| {
dfatal "Cannot create /dev/random"
dfatal "To create an initramfs with fips support, dracut has to run as root"
return 1
}
}
|
