From 14310ca42f06c2156ab5cefd05dbaa47ae3b054d Mon Sep 17 00:00:00 2001 From: Jonathan Lebon Date: Tue, 29 Oct 2019 16:47:34 -0400 Subject: [PATCH] 01fips: run sha512hmac from directory HMAC file directory That way, the HMAC file can contain a relative path instead of an absolute one. The issue is that right now the kernel RPM bakes the `/boot/vmlinuz-${kver}` path into the HMAC file which poses an issue for rpm-ostree systems (and any other system where the kernel isn't simply in the top-level `/boot`. For now, we're hacking around this in rpm-ostree: https://github.com/coreos/rpm-ostree/pull/1934 Though I'd like to propose the same change in the kernel spec file. --- modules.d/01fips/fips.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh index c3dbcf74..893143d0 100755 --- a/modules.d/01fips/fips.sh +++ b/modules.d/01fips/fips.sh @@ -135,7 +135,7 @@ do_fips() return 1 fi - sha512hmac -c "${BOOT_IMAGE_HMAC}" || return 1 + (cd "${BOOT_IMAGE_HMAC%/*}" && sha512hmac -c "${BOOT_IMAGE_HMAC}") || return 1 fi info "All initrd crypto checks done"