fips: add 'ofb' and 'cts' block cipher modes

[thirdparty/dracut.git] / modules.d / 01fips / module-setup.sh

diff --git a/modules.d/01fips/module-setup.sh b/modules.d/01fips/module-setup.sh
index 64932901d752a18f3d4d7f90c932bbe8f3c85084..b723dc6ca4eb6a2f7054d7bb556c0a4fe1a4bec4 100755 (executable)
--- a/modules.d/01fips/module-setup.sh
+++ b/modules.d/01fips/module-setup.sh
@@ -1,6 +1,4 @@
 #!/bin/bash
-# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
-# ex: ts=8 sw=4 sts=4 et filetype=sh
 
 # called by dracut
 check() {
@@ -14,12 +12,32 @@ depends() {
 
 # called by dracut
 installkernel() {
-    local _fipsmodules _mod
-    _fipsmodules="aead aes_generic aes-x86_64 ansi_cprng arc4 blowfish camellia cast6 cbc ccm "
-    _fipsmodules+="chainiv crc32c cryptomgr crypto_null ctr cts deflate des des3_ede dm-crypt dm-mod "
-    _fipsmodules+="ecb eseqiv fcrypt gcm ghash_generic hmac khazad lzo md4 md5 michael_mic rmd128 "
-    _fipsmodules+="rmd160 rmd256 rmd320 rot13 salsa20 seed seqiv serpent sha1 sha224 sha256 sha256_generic "
-    _fipsmodules+="sha384 sha512 sha512_generic tcrypt tea tnepres twofish wp256 wp384 wp512 xeta xtea xts zlib"
+    local _fipsmodules _mod _bootfstype
+    if [[ -f "${srcmods}/modules.fips" ]]; then
+        _fipsmodules="$(cat "${srcmods}/modules.fips")"
+    else
+        _fipsmodules=""
+
+        # Hashes:
+        _fipsmodules+="sha1 sha224 sha256 sha384 sha512 "
+        _fipsmodules+="sha3-224 sha3-256 sha3-384 sha3-512 "
+        _fipsmodules+="crc32c crct10dif ghash "
+
+        # Ciphers:
+        _fipsmodules+="cipher_null des3_ede aes cfb "
+
+        # Modes/templates:
+        _fipsmodules+="ecb cbc ctr xts gcm ccm authenc hmac cmac ofb cts "
+
+        # Compression algs:
+        _fipsmodules+="deflate lzo zlib "
+
+        # PRNG algs:
+        _fipsmodules+="ansi_cprng "
+
+        # Misc:
+        _fipsmodules+="aead cryptomgr tcrypt crypto_user "
+    fi
 
     mkdir -m 0755 -p "${initdir}/etc/modprobe.d"
 
@@ -29,21 +47,39 @@ installkernel() {
             echo "blacklist $_mod" >> "${initdir}/etc/modprobe.d/fips.conf"
         fi
     done
+
+    # with hostonly_default_device fs module for /boot is not installed by default
+    if [[ $hostonly ]] && [[ "$hostonly_default_device" == "no" ]]; then
+        _bootfstype=$(find_mp_fstype /boot)
+        if [[ -n "$_bootfstype" ]]; then
+            hostonly='' instmods $_bootfstype
+        else
+            dwarning "Can't determine fs type for /boot, FIPS check may fail."
+        fi
+    fi
 }
 
 # called by dracut
 install() {
     local _dir
-    inst_hook pre-trigger 01 "$moddir/fips-boot.sh"
+    inst_hook pre-mount 01 "$moddir/fips-boot.sh"
     inst_hook pre-pivot 01 "$moddir/fips-noboot.sh"
+    inst_hook pre-udev 01 "$moddir/fips-load-crypto.sh"
     inst_script "$moddir/fips.sh" /sbin/fips.sh
 
-    inst_multiple sha512hmac rmmod insmod mount uname umount fipscheck
+    inst_multiple sha512hmac rmmod insmod mount uname umount
 
-    inst_libdir_file libsoftokn3.so libsoftokn3.so \
-        libsoftokn3.chk libfreebl3.so libfreebl3.chk \
-        libssl.so 'hmaccalc/sha512hmac.hmac' libssl.so.10
-
-    inst_multiple -o prelink
+    inst_simple /etc/system-fips
+    [ -c ${initdir}/dev/random ] || mknod ${initdir}/dev/random c 1 8 \
+        || {
+            dfatal "Cannot create /dev/random"
+            dfatal "To create an initramfs with fips support, dracut has to run as root"
+            return 1
+        }
+    [ -c ${initdir}/dev/urandom ] || mknod ${initdir}/dev/urandom c 1 9 \
+        || {
+            dfatal "Cannot create /dev/random"
+            dfatal "To create an initramfs with fips support, dracut has to run as root"
+            return 1
+        }
 }
-