modules.d/01fips/fips.sh

   1 #!/bin/sh
   2 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
   3 # ex: ts=8 sw=4 sts=4 et filetype=sh
   4
   5 mount_boot()
   6 {
   7     boot=$(getarg boot=)
   8
   9     if [ -n "$boot" ]; then
  10         case "$boot" in
  11         LABEL=*)
  12             boot="$(echo $boot | sed 's,/,\\x2f,g')"
  13             boot="/dev/disk/by-label/${boot#LABEL=}"
  14             ;;
  15         UUID=*)
  16             boot="/dev/disk/by-uuid/${boot#UUID=}"
  17             ;;
  18         PARTUUID=*)
  19             boot="/dev/disk/by-partuuid/${boot#PARTUUID=}"
  20             ;;
  21         PARTLABEL=*)
  22             boot="/dev/disk/by-partlabel/${boot#PARTLABEL=}"
  23             ;;
  24         /dev/*)
  25             ;;
  26         *)
  27             die "You have to specify boot=<boot device> as a boot option for fips=1" ;;
  28         esac
  29
  30         if ! [ -e "$boot" ]; then
  31             udevadm trigger --action=add >/dev/null 2>&1
  32             [ -z "$UDEVVERSION" ] && UDEVVERSION=$(udevadm --version)
  33             i=0
  34             while ! [ -e $boot ]; do
  35                 if [ $UDEVVERSION -ge 143 ]; then
  36                     udevadm settle --exit-if-exists=$boot
  37                 else
  38                     udevadm settle --timeout=30
  39                 fi
  40                 [ -e $boot ] && break
  41                 sleep 0.5
  42                 i=$(($i+1))
  43                 [ $i -gt 40 ] && break
  44             done
  45         fi
  46
  47         [ -e "$boot" ] || return 1
  48
  49         mkdir /boot
  50         info "Mounting $boot as /boot"
  51         mount -oro "$boot" /boot || return 1
  52     elif [ -d "$NEWROOT/boot" ]; then
  53         rm -fr -- /boot
  54         ln -sf "$NEWROOT/boot" /boot
  55     fi
  56 }
  57
  58 do_rhevh_check()
  59 {
  60     KERNEL=$(uname -r)
  61     kpath=${1}
  62
  63     # If we're on RHEV-H, the kernel is in /dev/.initramfs/live/vmlinuz0
  64     HMAC_SUM_ORIG=$(cat /boot/.vmlinuz-${KERNEL}.hmac | while read a b; do printf "%s\n" $a; done)
  65     HMAC_SUM_CALC=$(sha512hmac $kpath | while read a b; do printf "%s\n" $a; done || return 1)
  66     if [ -z "$HMAC_SUM_ORIG" ] || [ -z "$HMAC_SUM_CALC" ] || [ "${HMAC_SUM_ORIG}" != "${HMAC_SUM_CALC}" ]; then
  67         warn "HMAC sum mismatch"
  68         return 1
  69     fi
  70     info "rhevh_check OK"
  71     return 0
  72 }
  73
  74 do_fips()
  75 {
  76     local _v
  77     local _s
  78     local _v
  79     local _module
  80
  81     KERNEL=$(uname -r)
  82
  83     if ! [ -e "/boot/.vmlinuz-${KERNEL}.hmac" ]; then
  84         warn "/boot/.vmlinuz-${KERNEL}.hmac does not exist"
  85         return 1
  86     fi
  87
  88     FIPSMODULES=$(cat /etc/fipsmodules)
  89
  90     info "Loading and integrity checking all crypto modules"
  91     mv /etc/modprobe.d/fips.conf /etc/modprobe.d/fips.conf.bak
  92     for _module in $FIPSMODULES; do
  93         if [ "$_module" != "tcrypt" ]; then
  94             if ! modprobe "${_module}"; then
  95                 # check if kernel provides generic algo
  96                 _found=0
  97                 while read _k _s _v; do
  98                     [ "$_k" != "name" -a "$_k" != "driver" ] && continue
  99                     [ "$_k" = "driver" ] && _v=$(str_replace "$_v" "_" "-")
 100                     [ "$_v" != "$_module" ] && continue
 101                     _found=1
 102                     break
 103                 done </proc/crypto
 104                 [ "$_found" = "0" ] && return 1
 105             fi
 106         fi
 107     done
 108     mv /etc/modprobe.d/fips.conf.bak /etc/modprobe.d/fips.conf
 109
 110     info "Self testing crypto algorithms"
 111     modprobe tcrypt || return 1
 112     rmmod tcrypt
 113
 114     info "Checking integrity of kernel"
 115     if [ -e "$NEWROOT/dev/.initramfs/live/vmlinuz0" ]; then
 116         do_rhevh_check "$NEWROOT/dev/.initramfs/live/vmlinuz0" || return 1
 117     elif [ -e "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" ]; then
 118         do_rhevh_check "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" || return 1
 119     else
 120         sha512hmac -c "/boot/.vmlinuz-${KERNEL}.hmac" || return 1
 121     fi
 122
 123     info "All initrd crypto checks done"
 124
 125     > /tmp/fipsdone
 126
 127     umount /boot >/dev/null 2>&1
 128
 129     return 0
 130 }