|
 |
49e6a8 |
From c6ccef8827af134884c5b2c785e07eb0b144450b Mon Sep 17 00:00:00 2001
|
|
|
49e6a8 |
From: Kairui Song <kasong@redhat.com>
|
|
|
49e6a8 |
Date: Thu, 14 Mar 2019 18:54:10 +0800
|
|
|
49e6a8 |
Subject: [PATCH] fips: ensure fs module for /boot is installed
|
|
|
49e6a8 |
|
|
|
49e6a8 |
When using dracut with --hostonly and --no-hostonly-default-device,
|
|
|
49e6a8 |
/boot will be inaccessible as dracut will most fs modules unless
|
|
|
49e6a8 |
specified. But FIPS require /boot to be accessible, and it will try
|
|
|
49e6a8 |
to mount it on boot. It will fail if corresponding fs module is missing.
|
|
|
49e6a8 |
|
|
|
49e6a8 |
For most case /boot will be a simple partition, include the fs module
|
|
|
49e6a8 |
will be enough for FIPS to mount it. For other cases users have to pass
|
|
|
49e6a8 |
extra parameters by themselves.
|
|
|
49e6a8 |
|
|
|
49e6a8 |
Suggested-by: Kenneth Dsouza <kdsouza@redhat.com>
|
|
|
49e6a8 |
Signed-off-by: Kairui Song <kasong@redhat.com>
|
|
|
49e6a8 |
|
|
|
49e6a8 |
Cherry-picked from: 8365177644bee107dcb66a71c8a7509900c9ece4
|
|
|
49e6a8 |
Resolves: #1672817
|
|
|
49e6a8 |
---
|
|
|
49e6a8 |
modules.d/01fips/module-setup.sh | 12 +++++++++++-
|
|
|
49e6a8 |
1 file changed, 11 insertions(+), 1 deletion(-)
|
|
|
49e6a8 |
|
|
|
49e6a8 |
diff --git a/modules.d/01fips/module-setup.sh b/modules.d/01fips/module-setup.sh
|
|
|
49e6a8 |
index 242d4dd9..834e7d7d 100755
|
|
|
49e6a8 |
--- a/modules.d/01fips/module-setup.sh
|
|
|
49e6a8 |
+++ b/modules.d/01fips/module-setup.sh
|
|
|
49e6a8 |
@@ -11,7 +11,7 @@ depends() {
|
|
|
49e6a8 |
}
|
|
|
49e6a8 |
|
|
|
49e6a8 |
installkernel() {
|
|
|
49e6a8 |
- local _fipsmodules _mod i
|
|
|
49e6a8 |
+ local _fipsmodules _mod i _bootfstype
|
|
|
49e6a8 |
|
|
|
49e6a8 |
if [[ -f "${srcmods}/modules.fips" ]]; then
|
|
|
49e6a8 |
_fipsmodules="$(cat "${srcmods}/modules.fips")"
|
|
|
49e6a8 |
@@ -36,6 +36,16 @@ installkernel() {
|
|
|
49e6a8 |
done
|
|
|
49e6a8 |
fi
|
|
|
49e6a8 |
done
|
|
|
49e6a8 |
+
|
|
|
49e6a8 |
+ # with hostonly_default_device fs module for /boot is not installed by default
|
|
|
49e6a8 |
+ if [[ $hostonly ]] && [[ "$hostonly_default_device" == "no" ]]; then
|
|
|
49e6a8 |
+ _bootfstype=$(find_mp_fstype /boot)
|
|
|
49e6a8 |
+ if [[ -n "$_bootfstype" ]]; then
|
|
|
49e6a8 |
+ hostonly='' instmods $_bootfstype
|
|
|
49e6a8 |
+ else
|
|
|
49e6a8 |
+ dwarning "Can't determine fs type for /boot, FIPS check may fail."
|
|
|
49e6a8 |
+ fi
|
|
|
49e6a8 |
+ fi
|
|
|
49e6a8 |
}
|
|
|
49e6a8 |
|
|
|
49e6a8 |
install() {
|