#!/bin/sh

[0] Fix | Delete

[1] Fix | Delete

mount_boot()

[2] Fix | Delete

{

[3] Fix | Delete

boot=$(getarg boot=)

[4] Fix | Delete

[5] Fix | Delete

if [ -n "$boot" ]; then

[6] Fix | Delete

case "$boot" in

[7] Fix | Delete

LABEL=*)

[8] Fix | Delete

boot="$(echo $boot | sed 's,/,\\x2f,g')"

[9] Fix | Delete

boot="/dev/disk/by-label/${boot#LABEL=}"

[10] Fix | Delete

;;

[11] Fix | Delete

UUID=*)

[12] Fix | Delete

boot="/dev/disk/by-uuid/${boot#UUID=}"

[13] Fix | Delete

;;

[14] Fix | Delete

PARTUUID=*)

[15] Fix | Delete

boot="/dev/disk/by-partuuid/${boot#PARTUUID=}"

[16] Fix | Delete

;;

[17] Fix | Delete

PARTLABEL=*)

[18] Fix | Delete

boot="/dev/disk/by-partlabel/${boot#PARTLABEL=}"

[19] Fix | Delete

;;

[20] Fix | Delete

/dev/*)

[21] Fix | Delete

;;

[22] Fix | Delete

*)

[23] Fix | Delete

die "You have to specify boot=<boot device> as a boot option for fips=1" ;;

[24] Fix | Delete

esac

[25] Fix | Delete

[26] Fix | Delete

if ! [ -e "$boot" ]; then

[27] Fix | Delete

udevadm trigger --action=add >/dev/null 2>&1

[28] Fix | Delete

[ -z "$UDEVVERSION" ] && UDEVVERSION=$(udevadm --version | { read v _ ; echo $v ; })

[29] Fix | Delete

i=0

[30] Fix | Delete

while ! [ -e $boot ]; do

[31] Fix | Delete

if [ $UDEVVERSION -ge 143 ]; then

[32] Fix | Delete

udevadm settle --exit-if-exists=$boot

[33] Fix | Delete

else

[34] Fix | Delete

udevadm settle --timeout=30

[35] Fix | Delete

fi

[36] Fix | Delete

[ -e $boot ] && break

[37] Fix | Delete

sleep 0.5

[38] Fix | Delete

i=$(($i+1))

[39] Fix | Delete

[ $i -gt 40 ] && break

[40] Fix | Delete

done

[41] Fix | Delete

fi

[42] Fix | Delete

[43] Fix | Delete

[ -e "$boot" ] || return 1

[44] Fix | Delete

[45] Fix | Delete

mkdir /boot

[46] Fix | Delete

info "Mounting $boot as /boot"

[47] Fix | Delete

mount -oro "$boot" /boot || return 1

[48] Fix | Delete

elif [ -d "$NEWROOT/boot" ]; then

[49] Fix | Delete

rm -fr -- /boot

[50] Fix | Delete

ln -sf "$NEWROOT/boot" /boot

[51] Fix | Delete

fi

[52] Fix | Delete

}

[53] Fix | Delete

[54] Fix | Delete

do_rhevh_check()

[55] Fix | Delete

{

[56] Fix | Delete

KERNEL=$(uname -r)

[57] Fix | Delete

kpath=${1}

[58] Fix | Delete

[59] Fix | Delete

# If we're on RHEV-H, the kernel is in /run/initramfs/live/vmlinuz0

[60] Fix | Delete

HMAC_SUM_ORIG=$(cat $NEWROOT/boot/.vmlinuz-${KERNEL}.hmac | while read a b || [ -n "$a" ]; do printf "%s\n" $a; done)

[61] Fix | Delete

HMAC_SUM_CALC=$(sha512hmac $kpath | while read a b || [ -n "$a" ]; do printf "%s\n" $a; done || return 1)

[62] Fix | Delete

if [ -z "$HMAC_SUM_ORIG" ] || [ -z "$HMAC_SUM_CALC" ] || [ "${HMAC_SUM_ORIG}" != "${HMAC_SUM_CALC}" ]; then

[63] Fix | Delete

warn "HMAC sum mismatch"

[64] Fix | Delete

return 1

[65] Fix | Delete

fi

[66] Fix | Delete

info "rhevh_check OK"

[67] Fix | Delete

return 0

[68] Fix | Delete

}

[69] Fix | Delete

[70] Fix | Delete

fips_load_crypto()

[71] Fix | Delete

{

[72] Fix | Delete

FIPSMODULES=$(cat /etc/fipsmodules)

[73] Fix | Delete

[74] Fix | Delete

info "Loading and integrity checking all crypto modules"

[75] Fix | Delete

mv /etc/modprobe.d/fips.conf /etc/modprobe.d/fips.conf.bak

[76] Fix | Delete

for _module in $FIPSMODULES; do

[77] Fix | Delete

if [ "$_module" != "tcrypt" ]; then

[78] Fix | Delete

if ! modprobe "${_module}" 2>/tmp/fips.modprobe_err; then

[79] Fix | Delete

# check if kernel provides generic algo

[80] Fix | Delete

_found=0

[81] Fix | Delete

while read _k _s _v || [ -n "$_k" ]; do

[82] Fix | Delete

[ "$_k" != "name" -a "$_k" != "driver" ] && continue

[83] Fix | Delete

[ "$_v" != "$_module" ] && continue

[84] Fix | Delete

_found=1

[85] Fix | Delete

break

[86] Fix | Delete

done </proc/crypto

[87] Fix | Delete

[ "$_found" = "0" ] && cat /tmp/fips.modprobe_err >&2 && return 1

[88] Fix | Delete

fi

[89] Fix | Delete

fi

[90] Fix | Delete

done

[91] Fix | Delete

mv /etc/modprobe.d/fips.conf.bak /etc/modprobe.d/fips.conf

[92] Fix | Delete

[93] Fix | Delete

info "Self testing crypto algorithms"

[94] Fix | Delete

modprobe tcrypt || return 1

[95] Fix | Delete

rmmod tcrypt

[96] Fix | Delete

}

[97] Fix | Delete

[98] Fix | Delete

do_fips()

[99] Fix | Delete

{

[100] Fix | Delete

local _v

[101] Fix | Delete

local _s

[102] Fix | Delete

local _v

[103] Fix | Delete

local _module

[104] Fix | Delete

[105] Fix | Delete

KERNEL=$(uname -r)

[106] Fix | Delete

[107] Fix | Delete

info "Checking integrity of kernel"

[108] Fix | Delete

if [ -e "/run/initramfs/live/vmlinuz0" ]; then

[109] Fix | Delete

do_rhevh_check /run/initramfs/live/vmlinuz0 || return 1

[110] Fix | Delete

elif [ -e "/run/initramfs/live/isolinux/vmlinuz0" ]; then

[111] Fix | Delete

do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1

[112] Fix | Delete

else

[113] Fix | Delete

BOOT_IMAGE="$(getarg BOOT_IMAGE)"

[114] Fix | Delete

[115] Fix | Delete

# On s390x, BOOT_IMAGE isn't a path but an integer representing the

[116] Fix | Delete

# entry number selected. Let's try the root of /boot first, and

[117] Fix | Delete

# otherwise fallback to trying to parse the BLS entries if it's a

[118] Fix | Delete

# BLS-based system.

[119] Fix | Delete

if [ "$(uname -m)" = s390x ]; then

[120] Fix | Delete

if [ -e "/boot/vmlinuz-${KERNEL}" ]; then

[121] Fix | Delete

BOOT_IMAGE="vmlinuz-${KERNEL}"

[122] Fix | Delete

elif [ -d /boot/loader/entries ]; then

[123] Fix | Delete

i=0

[124] Fix | Delete

for bls in $(ls -d /boot/loader/entries/*.conf | sort -rV); do

[125] Fix | Delete

if [ $i -eq ${BOOT_IMAGE:-0} ] && [ -r "$bls" ]; then

[126] Fix | Delete

BOOT_IMAGE="$(grep -e '^linux' "$bls" | grep -o ' .*$')"

[127] Fix | Delete

BOOT_IMAGE=${BOOT_IMAGE:1}

[128] Fix | Delete

break

[129] Fix | Delete

fi

[130] Fix | Delete

[131] Fix | Delete

((i++))

[132] Fix | Delete

done

[133] Fix | Delete

fi

[134] Fix | Delete

fi

[135] Fix | Delete

[136] Fix | Delete

# Trim off any leading GRUB boot device (e.g. ($root) )

[137] Fix | Delete

BOOT_IMAGE="$(echo "${BOOT_IMAGE}" | sed 's/^(.*)//')"

[138] Fix | Delete

[139] Fix | Delete

BOOT_IMAGE_NAME="${BOOT_IMAGE##*/}"

[140] Fix | Delete

BOOT_IMAGE_PATH="${BOOT_IMAGE%${BOOT_IMAGE_NAME}}"

[141] Fix | Delete

[142] Fix | Delete

if [ -z "$BOOT_IMAGE_NAME" ]; then

[143] Fix | Delete

BOOT_IMAGE_NAME="vmlinuz-${KERNEL}"

[144] Fix | Delete

elif ! [ -e "/boot/${BOOT_IMAGE_PATH}/${BOOT_IMAGE_NAME}" ]; then

[145] Fix | Delete

#if /boot is not a separate partition BOOT_IMAGE might start with /boot

[146] Fix | Delete

BOOT_IMAGE_PATH=${BOOT_IMAGE_PATH#"/boot"}

[147] Fix | Delete

#on some achitectures BOOT_IMAGE does not contain path to kernel

[148] Fix | Delete

#so if we can't find anything, let's treat it in the same way as if it was empty

[149] Fix | Delete

if ! [ -e "/boot/${BOOT_IMAGE_PATH}/${BOOT_IMAGE_NAME}" ]; then

[150] Fix | Delete

BOOT_IMAGE_NAME="vmlinuz-${KERNEL}"

[151] Fix | Delete

BOOT_IMAGE_PATH=""

[152] Fix | Delete

fi

[153] Fix | Delete

fi

[154] Fix | Delete

[155] Fix | Delete

BOOT_IMAGE_HMAC="/boot/${BOOT_IMAGE_PATH}/.${BOOT_IMAGE_NAME}.hmac"

[156] Fix | Delete

if ! [ -e "${BOOT_IMAGE_HMAC}" ]; then

[157] Fix | Delete

warn "${BOOT_IMAGE_HMAC} does not exist"

[158] Fix | Delete

return 1

[159] Fix | Delete

fi

[160] Fix | Delete

[161] Fix | Delete

(cd "${BOOT_IMAGE_HMAC%/*}" && sha512hmac -c "${BOOT_IMAGE_HMAC}") || return 1

[162] Fix | Delete

fi

[163] Fix | Delete

[164] Fix | Delete

info "All initrd crypto checks done"

[165] Fix | Delete

[166] Fix | Delete

> /tmp/fipsdone

[167] Fix | Delete

[168] Fix | Delete

umount /boot >/dev/null 2>&1

[169] Fix | Delete

[170] Fix | Delete

return 0

[171] Fix | Delete

}

[172] Fix | Delete

[173] Fix | Delete