modules.d/01fips/module-setup.sh

   1 #!/bin/bash
   2
   3 # called by dracut
   4 check() {
   5     return 255
   6 }
   7
   8 # called by dracut
   9 depends() {
  10     return 0
  11 }
  12
  13 # called by dracut
  14 installkernel() {
  15     local _fipsmodules _mod
  16     if [[ -f "${srcmods}/modules.fips" ]]; then
  17         _fipsmodules="$(cat "${srcmods}/modules.fips")"
  18     else
  19         _fipsmodules="aead aes_generic aes-x86_64 ansi_cprng arc4 authenc authencesn blowfish camellia cast6 cbc ccm "
  20         _fipsmodules+="chainiv crc32c crct10dif_generic cryptomgr crypto_null ctr cts deflate des des3_ede dm-crypt dm-mod drbg "
  21         _fipsmodules+="ecb eseqiv fcrypt gcm ghash_generic hmac khazad lzo md4 md5 michael_mic rmd128 "
  22         _fipsmodules+="rmd160 rmd256 rmd320 rot13 salsa20 seed seqiv serpent sha1 sha224 sha256 sha256_generic "
  23         _fipsmodules+="sha384 sha512 sha512_generic tcrypt tea tnepres twofish wp256 wp384 wp512 xeta xtea xts zlib "
  24         _fipsmodules+="aes_s390 des_s390 prng sha256_s390 sha_common des_check_key ghash_s390 sha1_s390 sha512_s390"
  25     fi
  26
  27     mkdir -m 0755 -p "${initdir}/etc/modprobe.d"
  28
  29     for _mod in $_fipsmodules; do
  30         if hostonly='' instmods -c -s $_mod; then
  31             echo $_mod >> "${initdir}/etc/fipsmodules"
  32             echo "blacklist $_mod" >> "${initdir}/etc/modprobe.d/fips.conf"
  33         fi
  34     done
  35 }
  36
  37 # called by dracut
  38 install() {
  39     local _dir
  40     inst_hook pre-trigger 01 "$moddir/fips-boot.sh"
  41     inst_hook pre-pivot 01 "$moddir/fips-noboot.sh"
  42     inst_script "$moddir/fips.sh" /sbin/fips.sh
  43
  44     inst_multiple sha512hmac rmmod insmod mount uname umount fipscheck
  45
  46     inst_libdir_file libsoftokn3.so libsoftokn3.so \
  47         libsoftokn3.chk libfreebl3.so libfreebl3.chk \
  48         libssl.so 'hmaccalc/sha512hmac.hmac' libssl.so.10 \
  49         libfreeblpriv3.so libfreeblpriv3.chk
  50
  51     inst_multiple -o prelink
  52     inst_simple /etc/system-fips
  53     [ -c ${initdir}/dev/random ] || mknod ${initdir}/dev/random c 1 8 \
  54         || {
  55             dfatal "Cannot create /dev/random"
  56             dfatal "To create an initramfs with fips support, dracut has to run as root"
  57             return 1
  58         }
  59     [ -c ${initdir}/dev/urandom ] || mknod ${initdir}/dev/urandom c 1 9 \
  60         || {
  61             dfatal "Cannot create /dev/random"
  62             dfatal "To create an initramfs with fips support, dracut has to run as root"
  63             return 1
  64         }
  65 }