From 928da5744721842d3e02151323c3a1357baf0032 Mon Sep 17 00:00:00 2001

From: Harald Hoyer <harald@redhat.com>

Date: Fri, 8 Nov 2013 15:06:18 +0100

Subject: [PATCH] fips: fix RHEV vmlinuz check

---

 modules.d/01fips/fips.sh | 12 ++++++------

 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh

index 98dd1c2..7fa48f1 100755

--- a/modules.d/01fips/fips.sh

+++ b/modules.d/01fips/fips.sh

@@ -60,8 +60,8 @@ do_rhevh_check()

     KERNEL=$(uname -r)

     kpath=${1}

-    # If we're on RHEV-H, the kernel is in /dev/.initramfs/live/vmlinuz0

-    HMAC_SUM_ORIG=$(cat /boot/.vmlinuz-${KERNEL}.hmac | while read a b; do printf "%s\n" $a; done)

+    # If we're on RHEV-H, the kernel is in /run/initramfs/live/vmlinuz0

+    HMAC_SUM_ORIG=$(cat $NEWROOT/boot/.vmlinuz-${KERNEL}.hmac | while read a b; do printf "%s\n" $a; done)

     HMAC_SUM_CALC=$(sha512hmac $kpath | while read a b; do printf "%s\n" $a; done || return 1)

     if [ -z "$HMAC_SUM_ORIG" ] || [ -z "$HMAC_SUM_CALC" ] || [ "${HMAC_SUM_ORIG}" != "${HMAC_SUM_CALC}" ]; then

         warn "HMAC sum mismatch"

@@ -111,10 +111,10 @@ do_fips()

     rmmod tcrypt

     info "Checking integrity of kernel"

-    if [ -e "$NEWROOT/dev/.initramfs/live/vmlinuz0" ]; then

-        do_rhevh_check "$NEWROOT/dev/.initramfs/live/vmlinuz0" || return 1

-    elif [ -e "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" ]; then

-        do_rhevh_check "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" || return 1

+    if [ -e "/run/initramfs/live/vmlinuz0" ]; then

+        do_rhevh_check /run/initramfs/live/vmlinuz0 || return 1

+    elif [ -e "/run/initramfs/live/isolinux/vmlinuz0" ]; then

+        do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1

     else

         sha512hmac -c "/boot/.vmlinuz-${KERNEL}.hmac" || return 1

     fi