fips.sh 0000755 00000013035 15173317007 0006052 0 ustar 00 #!/bin/sh
mount_boot()
{
boot=$(getarg boot=)
if [ -n "$boot" ]; then
case "$boot" in
LABEL=*)
boot="$(echo $boot | sed 's,/,\\x2f,g')"
boot="/dev/disk/by-label/${boot#LABEL=}"
;;
UUID=*)
boot="/dev/disk/by-uuid/${boot#UUID=}"
;;
PARTUUID=*)
boot="/dev/disk/by-partuuid/${boot#PARTUUID=}"
;;
PARTLABEL=*)
boot="/dev/disk/by-partlabel/${boot#PARTLABEL=}"
;;
/dev/*)
;;
*)
die "You have to specify boot=<boot device> as a boot option for fips=1" ;;
esac
if ! [ -e "$boot" ]; then
udevadm trigger --action=add >/dev/null 2>&1
[ -z "$UDEVVERSION" ] && UDEVVERSION=$(udevadm --version | { read v _ ; echo $v ; })
i=0
while ! [ -e $boot ]; do
if [ $UDEVVERSION -ge 143 ]; then
udevadm settle --exit-if-exists=$boot
else
udevadm settle --timeout=30
fi
[ -e $boot ] && break
sleep 0.5
i=$(($i+1))
[ $i -gt 40 ] && break
done
fi
[ -e "$boot" ] || return 1
mkdir /boot
info "Mounting $boot as /boot"
mount -oro "$boot" /boot || return 1
elif [ -d "$NEWROOT/boot" ]; then
rm -fr -- /boot
ln -sf "$NEWROOT/boot" /boot
fi
}
do_rhevh_check()
{
KERNEL=$(uname -r)
kpath=${1}
# If we're on RHEV-H, the kernel is in /run/initramfs/live/vmlinuz0
HMAC_SUM_ORIG=$(cat $NEWROOT/boot/.vmlinuz-${KERNEL}.hmac | while read a b || [ -n "$a" ]; do printf "%s\n" $a; done)
HMAC_SUM_CALC=$(sha512hmac $kpath | while read a b || [ -n "$a" ]; do printf "%s\n" $a; done || return 1)
if [ -z "$HMAC_SUM_ORIG" ] || [ -z "$HMAC_SUM_CALC" ] || [ "${HMAC_SUM_ORIG}" != "${HMAC_SUM_CALC}" ]; then
warn "HMAC sum mismatch"
return 1
fi
info "rhevh_check OK"
return 0
}
fips_load_crypto()
{
FIPSMODULES=$(cat /etc/fipsmodules)
info "Loading and integrity checking all crypto modules"
mv /etc/modprobe.d/fips.conf /etc/modprobe.d/fips.conf.bak
for _module in $FIPSMODULES; do
if [ "$_module" != "tcrypt" ]; then
if ! modprobe "${_module}" 2>/tmp/fips.modprobe_err; then
# check if kernel provides generic algo
_found=0
while read _k _s _v || [ -n "$_k" ]; do
[ "$_k" != "name" -a "$_k" != "driver" ] && continue
[ "$_v" != "$_module" ] && continue
_found=1
break
done </proc/crypto
[ "$_found" = "0" ] && cat /tmp/fips.modprobe_err >&2 && return 1
fi
fi
done
mv /etc/modprobe.d/fips.conf.bak /etc/modprobe.d/fips.conf
info "Self testing crypto algorithms"
modprobe tcrypt || return 1
rmmod tcrypt
}
do_fips()
{
local _v
local _s
local _v
local _module
KERNEL=$(uname -r)
info "Checking integrity of kernel"
if [ -e "/run/initramfs/live/vmlinuz0" ]; then
do_rhevh_check /run/initramfs/live/vmlinuz0 || return 1
elif [ -e "/run/initramfs/live/isolinux/vmlinuz0" ]; then
do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1
else
BOOT_IMAGE="$(getarg BOOT_IMAGE)"
# On s390x, BOOT_IMAGE isn't a path but an integer representing the
# entry number selected. Let's try the root of /boot first, and
# otherwise fallback to trying to parse the BLS entries if it's a
# BLS-based system.
if [ "$(uname -m)" = s390x ]; then
if [ -e "/boot/vmlinuz-${KERNEL}" ]; then
BOOT_IMAGE="vmlinuz-${KERNEL}"
elif [ -d /boot/loader/entries ]; then
i=0
for bls in $(ls -d /boot/loader/entries/*.conf | sort -rV); do
if [ $i -eq ${BOOT_IMAGE:-0} ] && [ -r "$bls" ]; then
BOOT_IMAGE="$(grep -e '^linux' "$bls" | grep -o ' .*$')"
BOOT_IMAGE=${BOOT_IMAGE:1}
break
fi
((i++))
done
fi
fi
# Trim off any leading GRUB boot device (e.g. ($root) )
BOOT_IMAGE="$(echo "${BOOT_IMAGE}" | sed 's/^(.*)//')"
BOOT_IMAGE_NAME="${BOOT_IMAGE##*/}"
BOOT_IMAGE_PATH="${BOOT_IMAGE%${BOOT_IMAGE_NAME}}"
if [ -z "$BOOT_IMAGE_NAME" ]; then
BOOT_IMAGE_NAME="vmlinuz-${KERNEL}"
elif ! [ -e "/boot/${BOOT_IMAGE_PATH}/${BOOT_IMAGE_NAME}" ]; then
#if /boot is not a separate partition BOOT_IMAGE might start with /boot
BOOT_IMAGE_PATH=${BOOT_IMAGE_PATH#"/boot"}
#on some achitectures BOOT_IMAGE does not contain path to kernel
#so if we can't find anything, let's treat it in the same way as if it was empty
if ! [ -e "/boot/${BOOT_IMAGE_PATH}/${BOOT_IMAGE_NAME}" ]; then
BOOT_IMAGE_NAME="vmlinuz-${KERNEL}"
BOOT_IMAGE_PATH=""
fi
fi
BOOT_IMAGE_HMAC="/boot/${BOOT_IMAGE_PATH}/.${BOOT_IMAGE_NAME}.hmac"
if ! [ -e "${BOOT_IMAGE_HMAC}" ]; then
warn "${BOOT_IMAGE_HMAC} does not exist"
return 1
fi
(cd "${BOOT_IMAGE_HMAC%/*}" && sha512hmac -c "${BOOT_IMAGE_HMAC}") || return 1
fi
info "All initrd crypto checks done"
> /tmp/fipsdone
umount /boot >/dev/null 2>&1
return 0
}
fips-boot.sh 0000755 00000000411 15173317007 0007005 0 ustar 00 #!/bin/sh
if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then
rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1
elif getarg boot= >/dev/null; then
. /sbin/fips.sh
if mount_boot; then
do_fips || die "FIPS integrity test failed"
fi
fi
module-setup.sh 0000755 00000004621 15173317007 0007535 0 ustar 00 #!/bin/bash
# called by dracut
check() {
return 0
}
# called by dracut
depends() {
return 0
}
# called by dracut
installkernel() {
local _fipsmodules _mod _bootfstype
if [[ -f "${srcmods}/modules.fips" ]]; then
_fipsmodules="$(cat "${srcmods}/modules.fips")"
else
_fipsmodules=""
# Hashes:
_fipsmodules+="sha1 sha224 sha256 sha384 sha512 "
_fipsmodules+="sha3-224 sha3-256 sha3-384 sha3-512 "
_fipsmodules+="crc32c crct10dif ghash "
# Ciphers:
_fipsmodules+="cipher_null des3_ede aes cfb dh ecdh "
# Modes/templates:
_fipsmodules+="ecb cbc ctr xts gcm ccm authenc hmac cmac "
# Compression algs:
_fipsmodules+="deflate lzo zlib "
# PRNG algs:
_fipsmodules+="ansi_cprng "
# Misc:
_fipsmodules+="aead cryptomgr tcrypt crypto_user "
fi
mkdir -m 0755 -p "${initdir}/etc/modprobe.d"
for _mod in $_fipsmodules; do
if hostonly='' instmods -c -s $_mod; then
echo $_mod >> "${initdir}/etc/fipsmodules"
echo "blacklist $_mod" >> "${initdir}/etc/modprobe.d/fips.conf"
fi
done
# with hostonly_default_device fs module for /boot is not installed by default
if [[ $hostonly ]] && [[ "$hostonly_default_device" == "no" ]]; then
_bootfstype=$(find_mp_fstype /boot)
if [[ -n "$_bootfstype" ]]; then
hostonly='' instmods $_bootfstype
else
dwarning "Can't determine fs type for /boot, FIPS check may fail."
fi
fi
}
# called by dracut
install() {
local _dir
inst_hook pre-trigger 01 "$moddir/fips-boot.sh"
inst_hook pre-pivot 01 "$moddir/fips-noboot.sh"
inst_hook pre-udev 01 "$moddir/fips-load-crypto.sh"
inst_script "$moddir/fips.sh" /sbin/fips.sh
inst_multiple sha512hmac rmmod insmod mount uname umount grep sort
inst_simple /etc/system-fips
[ -c ${initdir}/dev/random ] || mknod ${initdir}/dev/random c 1 8 \
|| {
dfatal "Cannot create /dev/random"
dfatal "To create an initramfs with fips support, dracut has to run as root"
return 1
}
[ -c ${initdir}/dev/urandom ] || mknod ${initdir}/dev/urandom c 1 9 \
|| {
dfatal "Cannot create /dev/random"
dfatal "To create an initramfs with fips support, dracut has to run as root"
return 1
}
}
fips-noboot.sh 0000755 00000000364 15173317007 0007351 0 ustar 00 #!/bin/sh
if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then
rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1
elif ! [ -f /tmp/fipsdone ]; then
. /sbin/fips.sh
mount_boot
do_fips || die "FIPS integrity test failed"
fi
fips-load-crypto.sh 0000644 00000000321 15173317007 0010274 0 ustar 00 #!/bin/sh
if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then
rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1
else
. /sbin/fips.sh
fips_load_crypto || die "FIPS integrity test failed"
fi
