# called by dracut
installkernel() {
- local _fipsmodules _mod
+ local _fipsmodules _mod _bootfstype
if [[ -f "${srcmods}/modules.fips" ]]; then
_fipsmodules="$(cat "${srcmods}/modules.fips")"
else
- _fipsmodules="aead aes_generic aes-x86_64 ansi_cprng arc4 authenc authencesn blowfish camellia cast6 cbc ccm "
- _fipsmodules+="chainiv crc32c crct10dif_generic cryptomgr crypto_null ctr cts deflate des des3_ede dm-crypt dm-mod drbg "
- _fipsmodules+="ecb eseqiv fcrypt gcm ghash_generic hmac khazad lzo md4 md5 michael_mic rmd128 "
- _fipsmodules+="rmd160 rmd256 rmd320 rot13 salsa20 seed seqiv serpent sha1 sha224 sha256 sha256_generic "
- _fipsmodules+="sha384 sha512 sha512_generic tcrypt tea tnepres twofish wp256 wp384 wp512 xeta xtea xts zlib "
- _fipsmodules+="aes_s390 des_s390 prng sha256_s390 sha_common des_check_key ghash_s390 sha1_s390 sha512_s390 "
- _fipsmodules+="cmac authenc sha3_generic sm3_generic crypto_user "
+ _fipsmodules=""
+
+ # Hashes:
+ _fipsmodules+="sha1 sha224 sha256 sha384 sha512 "
+ _fipsmodules+="sha3-224 sha3-256 sha3-384 sha3-512 "
+ _fipsmodules+="crc32c crct10dif ghash "
+
+ # Ciphers:
+ _fipsmodules+="cipher_null des3_ede aes cfb "
+
+ # Modes/templates:
+ _fipsmodules+="ecb cbc ctr xts gcm ccm authenc hmac cmac ofb cts "
+
+ # Compression algs:
+ _fipsmodules+="deflate lzo zlib "
+
+ # PRNG algs:
+ _fipsmodules+="ansi_cprng "
+
+ # Misc:
+ _fipsmodules+="aead cryptomgr tcrypt crypto_user "
fi
mkdir -m 0755 -p "${initdir}/etc/modprobe.d"
echo "blacklist $_mod" >> "${initdir}/etc/modprobe.d/fips.conf"
fi
done
+
+ # with hostonly_default_device fs module for /boot is not installed by default
+ if [[ $hostonly ]] && [[ "$hostonly_default_device" == "no" ]]; then
+ _bootfstype=$(find_mp_fstype /boot)
+ if [[ -n "$_bootfstype" ]]; then
+ hostonly='' instmods $_bootfstype
+ else
+ dwarning "Can't determine fs type for /boot, FIPS check may fail."
+ fi
+ fi
}
# called by dracut
install() {
local _dir
- inst_hook pre-trigger 01 "$moddir/fips-boot.sh"
+ inst_hook pre-mount 01 "$moddir/fips-boot.sh"
inst_hook pre-pivot 01 "$moddir/fips-noboot.sh"
+ inst_hook pre-udev 01 "$moddir/fips-load-crypto.sh"
inst_script "$moddir/fips.sh" /sbin/fips.sh
inst_multiple sha512hmac rmmod insmod mount uname umount