modules.d/01fips/module-setup.sh

   1 #!/bin/bash
   2 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
   3 # ex: ts=8 sw=4 sts=4 et filetype=sh
   4
   5 # called by dracut
   6 check() {
   7     return 255
   8 }
   9
  10 # called by dracut
  11 depends() {
  12     return 0
  13 }
  14
  15 # called by dracut
  16 installkernel() {
  17     local _fipsmodules _mod
  18     _fipsmodules="aead aes_generic aes-x86_64 ansi_cprng arc4 blowfish camellia cast6 cbc ccm "
  19     _fipsmodules+="chainiv crc32c crct10dif_generic cryptomgr crypto_null ctr cts deflate des des3_ede dm-crypt dm-mod "
  20     _fipsmodules+="ecb eseqiv fcrypt gcm ghash_generic hmac khazad lzo md4 md5 michael_mic rmd128 "
  21     _fipsmodules+="rmd160 rmd256 rmd320 rot13 salsa20 seed seqiv serpent sha1 sha224 sha256 sha256_generic "
  22     _fipsmodules+="sha384 sha512 sha512_generic tcrypt tea tnepres twofish wp256 wp384 wp512 xeta xtea xts zlib"
  23
  24     mkdir -m 0755 -p "${initdir}/etc/modprobe.d"
  25
  26     for _mod in $_fipsmodules; do
  27         if hostonly='' instmods -c -s $_mod; then
  28             echo $_mod >> "${initdir}/etc/fipsmodules"
  29             echo "blacklist $_mod" >> "${initdir}/etc/modprobe.d/fips.conf"
  30         fi
  31     done
  32 }
  33
  34 # called by dracut
  35 install() {
  36     local _dir
  37     inst_hook pre-trigger 01 "$moddir/fips-boot.sh"
  38     inst_hook pre-pivot 01 "$moddir/fips-noboot.sh"
  39     inst_script "$moddir/fips.sh" /sbin/fips.sh
  40
  41     inst_multiple sha512hmac rmmod insmod mount uname umount fipscheck
  42
  43     inst_libdir_file libsoftokn3.so libsoftokn3.so \
  44         libsoftokn3.chk libfreebl3.so libfreebl3.chk \
  45         libssl.so 'hmaccalc/sha512hmac.hmac' libssl.so.10
  46
  47     inst_multiple -o prelink
  48 }
  49