|
 |
966cef |
From ec72d9946bec0a9fcc386a1ea9915d6672eb7f94 Mon Sep 17 00:00:00 2001
|
|
|
966cef |
From: Harald Hoyer <harald@redhat.com>
|
|
|
966cef |
Date: Fri, 8 Nov 2013 15:06:18 +0100
|
|
|
966cef |
Subject: [PATCH] fips: fix RHEV vmlinuz check
|
|
|
966cef |
|
|
|
966cef |
---
|
|
|
966cef |
modules.d/01fips/fips.sh | 12 ++++++------
|
|
|
966cef |
1 file changed, 6 insertions(+), 6 deletions(-)
|
|
|
966cef |
|
|
|
966cef |
diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
|
|
|
966cef |
index 98dd1c2..7fa48f1 100755
|
|
|
966cef |
--- a/modules.d/01fips/fips.sh
|
|
|
966cef |
+++ b/modules.d/01fips/fips.sh
|
|
|
966cef |
@@ -60,8 +60,8 @@ do_rhevh_check()
|
|
|
966cef |
KERNEL=$(uname -r)
|
|
|
966cef |
kpath=${1}
|
|
|
966cef |
|
|
|
966cef |
- # If we're on RHEV-H, the kernel is in /dev/.initramfs/live/vmlinuz0
|
|
|
966cef |
- HMAC_SUM_ORIG=$(cat /boot/.vmlinuz-${KERNEL}.hmac | while read a b; do printf "%s\n" $a; done)
|
|
|
966cef |
+ # If we're on RHEV-H, the kernel is in /run/initramfs/live/vmlinuz0
|
|
|
966cef |
+ HMAC_SUM_ORIG=$(cat $NEWROOT/boot/.vmlinuz-${KERNEL}.hmac | while read a b; do printf "%s\n" $a; done)
|
|
|
966cef |
HMAC_SUM_CALC=$(sha512hmac $kpath | while read a b; do printf "%s\n" $a; done || return 1)
|
|
|
966cef |
if [ -z "$HMAC_SUM_ORIG" ] || [ -z "$HMAC_SUM_CALC" ] || [ "${HMAC_SUM_ORIG}" != "${HMAC_SUM_CALC}" ]; then
|
|
|
966cef |
warn "HMAC sum mismatch"
|
|
|
966cef |
@@ -111,10 +111,10 @@ do_fips()
|
|
|
966cef |
rmmod tcrypt
|
|
|
966cef |
|
|
|
966cef |
info "Checking integrity of kernel"
|
|
|
966cef |
- if [ -e "$NEWROOT/dev/.initramfs/live/vmlinuz0" ]; then
|
|
|
966cef |
- do_rhevh_check "$NEWROOT/dev/.initramfs/live/vmlinuz0" || return 1
|
|
|
966cef |
- elif [ -e "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" ]; then
|
|
|
966cef |
- do_rhevh_check "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" || return 1
|
|
|
966cef |
+ if [ -e "/run/initramfs/live/vmlinuz0" ]; then
|
|
|
966cef |
+ do_rhevh_check /run/initramfs/live/vmlinuz0 || return 1
|
|
|
966cef |
+ elif [ -e "/run/initramfs/live/isolinux/vmlinuz0" ]; then
|
|
|
966cef |
+ do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1
|
|
|
966cef |
else
|
|
|
966cef |
sha512hmac -c "/boot/.vmlinuz-${KERNEL}.hmac" || return 1
|
|
|
966cef |
fi
|