d8b7ac
From d8c0b10b15940d88a28acbcf93354e4da0babb8d Mon Sep 17 00:00:00 2001
d8b7ac
From: Kairui Song <kasong@redhat.com>
d8b7ac
Date: Wed, 10 Jun 2020 15:57:20 +0800
d8b7ac
Subject: [PATCH] dracut.sh: FIPS workaround for openssl-libs on Fedora/RHEL
d8b7ac
d8b7ac
On Fedora/RHEL, libcryto will verify both itself and libssl on start, if
d8b7ac
libssl is missing, FIPS self test will fail. However libssl is not a
d8b7ac
dependency of libcryto so dracut will not install it, unless some other
d8b7ac
binary or library pulls it in. Systemd requires libssl, so in most cases
d8b7ac
it just worked, but could fail in some corner cases where systemd is not
d8b7ac
used.
d8b7ac
d8b7ac
Signed-off-by: Kairui Song <kasong@redhat.com>
d8b7ac
(cherry picked from commit 5a4c3469338410b6aea9452994b4b0af1ba59be7)
d8b7ac
d8b7ac
Resolves: #1841077
d8b7ac
---
d8b7ac
 dracut.sh | 11 +++++++++++
d8b7ac
 1 file changed, 11 insertions(+)
d8b7ac
d8b7ac
diff --git a/dracut.sh b/dracut.sh
d8b7ac
index 4c5176a1..86e95449 100755
d8b7ac
--- a/dracut.sh
d8b7ac
+++ b/dracut.sh
d8b7ac
@@ -1840,6 +1840,17 @@ if [[ $kernel_only != yes ]]; then
d8b7ac
             break 2
d8b7ac
         done
d8b7ac
     done
d8b7ac
+
d8b7ac
+    # FIPS workaround for Fedora/RHEL: libcrypto needs libssl when FIPS is enabled
d8b7ac
+    if [[ $DRACUT_FIPS_MODE ]]; then
d8b7ac
+      for _dir in $libdirs; do
d8b7ac
+          for _f in "$dracutsysrootdir$_dir/libcrypto.so"*; do
d8b7ac
+              [[ -e "$_f" ]] || continue
d8b7ac
+              inst_libdir_file -o "libssl.so*"
d8b7ac
+              break 2
d8b7ac
+          done
d8b7ac
+      done
d8b7ac
+    fi
d8b7ac
 fi
d8b7ac
 
d8b7ac
 if [[ $do_strip = yes ]] && ! [[ $DRACUT_FIPS_MODE ]]; then
de1e8b