|
|
7629ac |
diff --git a/rhel7/fixes/anaconda/grub2_enable_fips_mode.anaconda b/rhel7/fixes/anaconda/grub2_enable_fips_mode.anaconda
|
|
|
7629ac |
new file mode 100644
|
|
|
7629ac |
index 0000000..99693f6
|
|
|
7629ac |
--- /dev/null
|
|
|
7629ac |
+++ b/rhel7/fixes/anaconda/grub2_enable_fips_mode.anaconda
|
|
|
7629ac |
@@ -0,0 +1,3 @@
|
|
|
7629ac |
+# platform = Red Hat Enterprise Linux 7
|
|
|
7629ac |
+
|
|
|
7629ac |
+package --add=dracut-fips
|
|
|
7629ac |
diff --git a/linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode.rule b/linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode.rule
|
|
|
7629ac |
index ac89c4e8ac..4f70107829 100644
|
|
|
7629ac |
--- a/linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode.rule
|
|
|
7629ac |
+++ b/linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode.rule
|
|
|
7629ac |
@@ -5,8 +5,9 @@ prodtype: rhel7
|
|
|
7629ac |
title: 'Enable FIPS Mode in GRUB2'
|
|
|
7629ac |
|
|
|
7629ac |
description: |-
|
|
|
7629ac |
- To ensure FIPS mode is enabled, rebuild <tt>initramfs</tt> by running the following command:
|
|
|
7629ac |
- dracut -f
|
|
|
7629ac |
+ To ensure FIPS mode is enabled, install package <tt>dracut-fips</tt>, and rebuild <tt>initramfs</tt> by running the following commands:
|
|
|
7629ac |
+ {{{ package_install("dracut-fips") }}}
|
|
|
7629ac |
+ dracut -f
|
|
|
7629ac |
After the <tt>dracut</tt> command has been run, add the argument <tt>fips=1</tt> to the default
|
|
|
7629ac |
GRUB 2 command line for the Linux operating system in
|
|
|
7629ac |
<tt>/etc/default/grub</tt>, in the manner below:
|
|
|
7629ac |
diff --git a/shared/macros-highlevel.jinja b/shared/macros-highlevel.jinja
|
|
|
7629ac |
index 722f15fd2a..d1dba54154 100644
|
|
|
7629ac |
--- a/shared/macros-highlevel.jinja
|
|
|
7629ac |
+++ b/shared/macros-highlevel.jinja
|
|
|
7629ac |
@@ -19,31 +19,39 @@
|
|
|
7629ac |
{{%- endif -%}}
|
|
|
7629ac |
{{%- endmacro %}}
|
|
|
7629ac |
|
|
|
7629ac |
-
|
|
|
7629ac |
{{%- macro describe_package_install(package) -%}}
|
|
|
7629ac |
+ The {{{ package }}} package can be installed with the following command:
|
|
|
7629ac |
+ {{{ package_install(package) }}}
|
|
|
7629ac |
+{{%- endmacro %}}
|
|
|
7629ac |
+
|
|
|
7629ac |
+{{%- macro package_install(package) -%}}
|
|
|
7629ac |
{{%- if pkg_manager == "apt_get" -%}}
|
|
|
7629ac |
- {{{ apt_get_describe_package_install(package) }}}
|
|
|
7629ac |
+ {{{ apt_get_package_install(package) }}}
|
|
|
7629ac |
{{%- elif pkg_manager == "zypper" -%}}
|
|
|
7629ac |
- {{{ zypper_describe_package_install(package) }}}
|
|
|
7629ac |
+ {{{ zypper_package_install(package) }}}
|
|
|
7629ac |
{{%- elif pkg_manager == "yum" -%}}
|
|
|
7629ac |
- {{{ yum_describe_package_install(package) }}}
|
|
|
7629ac |
+ {{{ yum_package_install(package) }}}
|
|
|
7629ac |
{{%- elif pkg_manager == "dnf" -%}}
|
|
|
7629ac |
- {{{ dnf_describe_package_install(package) }}}
|
|
|
7629ac |
+ {{{ dnf_package_install(package) }}}
|
|
|
7629ac |
{{%- else %}}
|
|
|
7629ac |
JINJA MACRO ERROR: Unknown package manager '{{{ pkg_manager }}}'.
|
|
|
7629ac |
{{%- endif -%}}
|
|
|
7629ac |
{{%- endmacro %}}
|
|
|
7629ac |
|
|
|
7629ac |
-
|
|
|
7629ac |
{{%- macro describe_package_remove(package) -%}}
|
|
|
7629ac |
+ The {{{ package }}} package can be removed with the following command:
|
|
|
7629ac |
+ {{{ package_remove(package) }}}
|
|
|
7629ac |
+{{%- endmacro %}}
|
|
|
7629ac |
+
|
|
|
7629ac |
+{{%- macro package_remove(package) -%}}
|
|
|
7629ac |
{{%- if pkg_manager == "apt_get" -%}}
|
|
|
7629ac |
- {{{ apt_get_describe_package_remove(package) }}}
|
|
|
7629ac |
+ {{{ apt_get_package_remove(package) }}}
|
|
|
7629ac |
{{%- elif pkg_manager == "zypper" -%}}
|
|
|
7629ac |
- {{{ zypper_describe_package_remove(package) }}}
|
|
|
7629ac |
+ {{{ zypper_package_remove(package) }}}
|
|
|
7629ac |
{{%- elif pkg_manager == "yum" -%}}
|
|
|
7629ac |
- {{{ yum_describe_package_remove(package) }}}
|
|
|
7629ac |
+ {{{ yum_package_remove(package) }}}
|
|
|
7629ac |
{{%- elif pkg_manager == "dnf" -%}}
|
|
|
7629ac |
- {{{ dnf_describe_package_remove(package) }}}
|
|
|
7629ac |
+ {{{ dnf_package_remove(package) }}}
|
|
|
7629ac |
{{%- else %}}
|
|
|
7629ac |
JINJA MACRO ERROR: Unknown package manager '{{{ pkg_manager }}}'.
|
|
|
7629ac |
{{%- endif -%}}
|
|
|
7629ac |
diff --git a/shared/macros.jinja b/shared/macros.jinja
|
|
|
7629ac |
index 2d93808ed2..e2b46e9a44 100644
|
|
|
7629ac |
--- a/shared/macros.jinja
|
|
|
7629ac |
+++ b/shared/macros.jinja
|
|
|
7629ac |
@@ -395,51 +395,43 @@ ocil_clause: "{{{ sebool }}} is not enabled"
|
|
|
7629ac |
{{%- endmacro %}}
|
|
|
7629ac |
|
|
|
7629ac |
|
|
|
7629ac |
-{{%- macro apt_get_describe_package_install(package) %}}
|
|
|
7629ac |
- The {{{ package }}} package can be installed with the following command:
|
|
|
7629ac |
- $ apt-get install {{{ package }}}
|
|
|
7629ac |
+{{%- macro apt_get_package_install(package) %}}
|
|
|
7629ac |
+ $ apt-get install {{{ package }}}
|
|
|
7629ac |
{{%- endmacro %}}
|
|
|
7629ac |
|
|
|
7629ac |
|
|
|
7629ac |
-{{%- macro apt_get_describe_package_remove(package) %}}
|
|
|
7629ac |
- The {{{ package }}} package can be removed with the following command:
|
|
|
7629ac |
- $ apt-get remove {{{ package }}}
|
|
|
7629ac |
+{{%- macro apt_get_package_remove(package) %}}
|
|
|
7629ac |
+ $ apt-get remove {{{ package }}}
|
|
|
7629ac |
{{%- endmacro %}}
|
|
|
7629ac |
|
|
|
7629ac |
|
|
|
7629ac |
-{{%- macro dnf_describe_package_install(package) %}}
|
|
|
7629ac |
- The {{{ package }}} package can be installed with the following command:
|
|
|
7629ac |
- $ sudo dnf install {{{ package }}}
|
|
|
7629ac |
+{{%- macro dnf_package_install(package) %}}
|
|
|
7629ac |
+ $ sudo dnf install {{{ package }}}
|
|
|
7629ac |
{{%- endmacro %}}
|
|
|
7629ac |
|
|
|
7629ac |
|
|
|
7629ac |
-{{%- macro dnf_describe_package_remove(package) %}}
|
|
|
7629ac |
- The {{{ package }}} package can be removed with the following command:
|
|
|
7629ac |
- $ sudo dnf erase {{{ package }}}
|
|
|
7629ac |
+{{%- macro dnf_package_remove(package) %}}
|
|
|
7629ac |
+ $ sudo dnf erase {{{ package }}}
|
|
|
7629ac |
{{%- endmacro %}}
|
|
|
7629ac |
|
|
|
7629ac |
|
|
|
7629ac |
-{{%- macro yum_describe_package_install(package) %}}
|
|
|
7629ac |
- The {{{ package }}} package can be installed with the following command:
|
|
|
7629ac |
- $ sudo yum install {{{ package }}}
|
|
|
7629ac |
+{{%- macro yum_package_install(package) %}}
|
|
|
7629ac |
+ $ sudo yum install {{{ package }}}
|
|
|
7629ac |
{{%- endmacro %}}
|
|
|
7629ac |
|
|
|
7629ac |
|
|
|
7629ac |
-{{%- macro yum_describe_package_remove(package) %}}
|
|
|
7629ac |
- The {{{ package }}} package can be removed with the following command:
|
|
|
7629ac |
- $ sudo yum erase {{{ package }}}
|
|
|
7629ac |
+{{%- macro yum_package_remove(package) %}}
|
|
|
7629ac |
+ $ sudo yum erase {{{ package }}}
|
|
|
7629ac |
{{%- endmacro %}}
|
|
|
7629ac |
|
|
|
7629ac |
|
|
|
7629ac |
-{{%- macro zypper_describe_package_install(package) %}}
|
|
|
7629ac |
- The {{{ package }}} package can be installed with the following command:
|
|
|
7629ac |
- $ sudo zypper install {{{ package }}}
|
|
|
7629ac |
+{{%- macro zypper_package_install(package) %}}
|
|
|
7629ac |
+ $ sudo zypper install {{{ package }}}
|
|
|
7629ac |
{{%- endmacro %}}
|
|
|
7629ac |
|
|
|
7629ac |
|
|
|
7629ac |
-{{%- macro zypper_describe_package_remove(package) %}}
|
|
|
7629ac |
- The {{{ package }}} package can be removed with the following command:
|
|
|
7629ac |
- $ sudo zypper remove {{{ package }}}
|
|
|
7629ac |
+{{%- macro zypper_package_remove(package) %}}
|
|
|
7629ac |
+ $ sudo zypper remove {{{ package }}}
|
|
|
7629ac |
{{%- endmacro %}}
|
|
|
7629ac |
|
|
|
7629ac |
|