From 9c54932f590fd7accadc780c6ee946a94286b7e6 Mon Sep 17 00:00:00 2001
From: Lukas Nykryn <lnykryn@redhat.com>
Date: Tue, 14 May 2019 09:23:55 +0200
Subject: [PATCH] fips: split loading the crypto modules and checking the
kernel
In e54ab383 we moved the fips script to a later pahse of boot, since
the /boot might not be available early on.
The problem is that systemd-cryptsetup* services could be run now
started before the do_fips is executed and need the crypto modules
to decrypted the devices.
So let's split the do_fips and load the module before udev does the
trigger.
---
modules.d/01fips/fips-load-crypto.sh | 8 ++++++++
modules.d/01fips/fips.sh | 19 +++++++++++--------
modules.d/01fips/module-setup.sh | 1 +
3 files changed, 20 insertions(+), 8 deletions(-)
diff --git a/modules.d/01fips/fips-load-crypto.sh b/modules.d/01fips/fips-load-crypto.sh
new file mode 100644
index 00000000..82cbeee4
--- /dev/null
+++ b/modules.d/01fips/fips-load-crypto.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then
+ rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1
+else
+ . /sbin/fips.sh
+ fips_load_crypto || die "FIPS integrity test failed"
+fi
diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
index 9bc089f2..beaa692b 100755
--- a/modules.d/01fips/fips.sh
+++ b/modules.d/01fips/fips.sh
@@ -69,15 +69,8 @@ do_rhevh_check()
return 0
}
-do_fips()
+fips_load_crypto()
{
- local _v
- local _s
- local _v
- local _module
-
- KERNEL=$(uname -r)
-
FIPSMODULES=$(cat /etc/fipsmodules)
info "Loading and integrity checking all crypto modules"
@@ -102,6 +95,16 @@ do_fips()
info "Self testing crypto algorithms"
modprobe tcrypt || return 1
rmmod tcrypt
+}
+
+do_fips()
+{
+ local _v
+ local _s
+ local _v
+ local _module
+
+ KERNEL=$(uname -r)
info "Checking integrity of kernel"
if [ -e "/run/initramfs/live/vmlinuz0" ]; then
diff --git a/modules.d/01fips/module-setup.sh b/modules.d/01fips/module-setup.sh
index f3af4d90..18186d62 100755
--- a/modules.d/01fips/module-setup.sh
+++ b/modules.d/01fips/module-setup.sh
@@ -54,6 +54,7 @@ install() {
local _dir
inst_hook pre-trigger 01 "$moddir/fips-boot.sh"
inst_hook pre-pivot 01 "$moddir/fips-noboot.sh"
+ inst_hook pre-udev 01 "$moddir/fips-load-crypto.sh"
inst_script "$moddir/fips.sh" /sbin/fips.sh
inst_multiple sha512hmac rmmod insmod mount uname umount