Blame SOURCES/0525-01fips-Fix-creating-path-to-.hmac-of-kernel-based-on.patch

5c6c2a
From 9b1d79993dbed054c5069f97204280a39ed61219 Mon Sep 17 00:00:00 2001
5c6c2a
From: Lukas Nykryn <lnykryn@redhat.com>
5c6c2a
Date: Mon, 18 Dec 2017 14:48:59 +0100
5c6c2a
Subject: [PATCH] 01fips: Fix creating path to .hmac of kernel based on
5c6c2a
 BOOT_IMAGE
5c6c2a
5c6c2a
Old code did not work for two most common use-cases.
5c6c2a
On most machines BOOT_IMAGE is set to something like
5c6c2a
/vmlinuz-4.11.3-202.fc25.x86_64. So if we just add prefix "/boot/."
5c6c2a
it won't work. Also on machines without /boot on separate partition
5c6c2a
BOOT_IMAGE already has the /boot/ prefix (/boot/vmlinuz-3.10.0-799.el7.x86_64).
5c6c2a
So let's strip it in such case.
5c6c2a
5c6c2a
https://bugzilla.redhat.com/show_bug.cgi?id=1415032
5c6c2a
5c6c2a
Cherry-picked from: 8f5c564cb30966878b0d90025568253016e1402f
5c6c2a
Resolves: #1415032
5c6c2a
---
5c6c2a
 modules.d/01fips/fips.sh | 14 ++++++++++----
5c6c2a
 1 file changed, 10 insertions(+), 4 deletions(-)
5c6c2a
5c6c2a
diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
5c6c2a
index ecd711c2..6c5dd60f 100755
5c6c2a
--- a/modules.d/01fips/fips.sh
5c6c2a
+++ b/modules.d/01fips/fips.sh
5c6c2a
@@ -112,13 +112,19 @@ do_fips()
5c6c2a
         do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1
5c6c2a
     else
5c6c2a
         BOOT_IMAGE="$(getarg BOOT_IMAGE)"
5c6c2a
-        [ -e "/boot/.${BOOT_IMAGE}.hmac" ] || BOOT_IMAGE="vmlinuz-${KERNEL}"
5c6c2a
+        if ! [ -e "/boot/${BOOT_IMAGE}" ]; then
5c6c2a
+            #if /boot is not a separate partition BOOT_IMAGE might start with /boot
5c6c2a
+            BOOT_IMAGE=${BOOT_IMAGE#"/boot"}
5c6c2a
+            [ -e "/boot/${BOOT_IMAGE}" ] || BOOT_IMAGE="vmlinuz-${KERNEL}"
5c6c2a
+        fi
5c6c2a
+        
5c6c2a
+        BOOT_IMAGE_HMAC="/boot/${BOOT_IMAGE%/*}/.${BOOT_IMAGE##*/}.hmac"
5c6c2a
 
5c6c2a
-        if ! [ -e "/boot/.${BOOT_IMAGE}.hmac" ]; then
5c6c2a
-            warn "/boot/.${BOOT_IMAGE}.hmac does not exist"
5c6c2a
+        if ! [ -e "${BOOT_IMAGE_HMAC}" ]; then
5c6c2a
+            warn "${BOOT_IMAGE_HMAC} does not exist"
5c6c2a
             return 1
5c6c2a
         fi
5c6c2a
-        sha512hmac -c "/boot/.${BOOT_IMAGE}.hmac" || return 1
5c6c2a
+        sha512hmac -c "${BOOT_IMAGE_HMAC}" || return 1
5c6c2a
     fi
5c6c2a
 
5c6c2a
     info "All initrd crypto checks done"