|
 |
1755ca |
From 744afe75315b975a7eb431d0a52f6056353bf8f1 Mon Sep 17 00:00:00 2001
|
|
|
1755ca |
From: Harald Hoyer <harald@redhat.com>
|
|
|
1755ca |
Date: Thu, 29 Jun 2017 10:38:09 +0200
|
|
|
1755ca |
Subject: [PATCH] Try BOOT_IMAGE and fallback to vmlinuz-${KERNEL}
|
|
|
1755ca |
|
|
|
1755ca |
On s390 BOOT_IMAGE only denotes the number of the boot record that
|
|
|
1755ca |
was selected in the bootloader and not the path to the kernel image.
|
|
|
1755ca |
|
|
|
1755ca |
Also only bail out, if the kernel hmac checking relies on that path.
|
|
|
1755ca |
|
|
|
1755ca |
Cherry-picked from: 3d875f77f3d1c5e4161794ca59025bc6bcd77eaa
|
|
|
1755ca |
Resolves: #1415032
|
|
|
1755ca |
---
|
|
|
1755ca |
modules.d/01fips/fips.sh | 13 +++++++------
|
|
|
1755ca |
1 file changed, 7 insertions(+), 6 deletions(-)
|
|
|
1755ca |
|
|
|
1755ca |
diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
|
|
|
1755ca |
index e9ed00b5..ecd711c2 100755
|
|
|
1755ca |
--- a/modules.d/01fips/fips.sh
|
|
|
1755ca |
+++ b/modules.d/01fips/fips.sh
|
|
|
1755ca |
@@ -79,12 +79,6 @@ do_fips()
|
|
|
1755ca |
local _module
|
|
|
1755ca |
|
|
|
1755ca |
KERNEL=$(uname -r)
|
|
|
1755ca |
- BOOT_IMAGE="$(getarg BOOT_IMAGE)"
|
|
|
1755ca |
- BOOT_IMAGE="${BOOT_IMAGE:-/vmlinuz-${KERNEL}}"
|
|
|
1755ca |
- if ! [ -e "/boot/.${BOOT_IMAGE}.hmac" ] && ! [ -e "/boot/.vmlinuz-${KERNEL}.hmac" ]; then
|
|
|
1755ca |
- warn "/boot/.${BOOT_IMAGE}.hmac does not exist"
|
|
|
1755ca |
- return 1
|
|
|
1755ca |
- fi
|
|
|
1755ca |
|
|
|
1755ca |
FIPSMODULES=$(cat /etc/fipsmodules)
|
|
|
1755ca |
|
|
|
1755ca |
@@ -117,6 +111,13 @@ do_fips()
|
|
|
1755ca |
elif [ -e "/run/initramfs/live/isolinux/vmlinuz0" ]; then
|
|
|
1755ca |
do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1
|
|
|
1755ca |
else
|
|
|
1755ca |
+ BOOT_IMAGE="$(getarg BOOT_IMAGE)"
|
|
|
1755ca |
+ [ -e "/boot/.${BOOT_IMAGE}.hmac" ] || BOOT_IMAGE="vmlinuz-${KERNEL}"
|
|
|
1755ca |
+
|
|
|
1755ca |
+ if ! [ -e "/boot/.${BOOT_IMAGE}.hmac" ]; then
|
|
|
1755ca |
+ warn "/boot/.${BOOT_IMAGE}.hmac does not exist"
|
|
|
1755ca |
+ return 1
|
|
|
1755ca |
+ fi
|
|
|
1755ca |
sha512hmac -c "/boot/.${BOOT_IMAGE}.hmac" || return 1
|
|
|
1755ca |
fi
|
|
|
1755ca |
|