#!/bin/bash
-# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
-# ex: ts=8 sw=4 sts=4 et filetype=sh
+# called by dracut
check() {
return 255
}
+# called by dracut
depends() {
return 0
}
+# called by dracut
installkernel() {
- FIPSMODULES="aead aes_generici aes-xts aes-x86_64 ansi_cprng cbc ccm chainiv ctr"
- FIPSMODULES="$FIPSMODULES des deflate ecb eseqiv hmac seqiv sha256 sha512"
- FIPSMODULES="$FIPSMODULES cryptomgr crypto_null tcrypt"
+ local _fipsmodules _mod _bootfstype
+ if [[ -f "${srcmods}/modules.fips" ]]; then
+ _fipsmodules="$(cat "${srcmods}/modules.fips")"
+ else
+ _fipsmodules=""
+
+ # Hashes:
+ _fipsmodules+="sha1 sha224 sha256 sha384 sha512 "
+ _fipsmodules+="sha3-224 sha3-256 sha3-384 sha3-512 "
+ _fipsmodules+="crc32c crct10dif ghash "
+
+ # Ciphers:
+ _fipsmodules+="cipher_null des3_ede aes cfb "
+
+ # Modes/templates:
+ _fipsmodules+="ecb cbc ctr xts gcm ccm authenc hmac cmac ofb cts "
+
+ # Compression algs:
+ _fipsmodules+="deflate lzo zlib "
+
+ # PRNG algs:
+ _fipsmodules+="ansi_cprng "
+
+ # Misc:
+ _fipsmodules+="aead cryptomgr tcrypt crypto_user "
+ fi
mkdir -m 0755 -p "${initdir}/etc/modprobe.d"
- for mod in $FIPSMODULES; do
- if instmods $mod; then
- echo $mod >> "${initdir}/etc/fipsmodules"
- echo "blacklist $mod" >> "${initdir}/etc/modprobe.d/fips.conf"
+ for _mod in $_fipsmodules; do
+ if hostonly='' instmods -c -s $_mod; then
+ echo $_mod >> "${initdir}/etc/fipsmodules"
+ echo "blacklist $_mod" >> "${initdir}/etc/modprobe.d/fips.conf"
fi
done
+
+ # with hostonly_default_device fs module for /boot is not installed by default
+ if [[ $hostonly ]] && [[ "$hostonly_default_device" == "no" ]]; then
+ _bootfstype=$(find_mp_fstype /boot)
+ if [[ -n "$_bootfstype" ]]; then
+ hostonly='' instmods $_bootfstype
+ else
+ dwarning "Can't determine fs type for /boot, FIPS check may fail."
+ fi
+ fi
}
+# called by dracut
install() {
- inst_hook pre-trigger 01 "$moddir/fips-boot.sh"
+ local _dir
+ inst_hook pre-mount 01 "$moddir/fips-boot.sh"
inst_hook pre-pivot 01 "$moddir/fips-noboot.sh"
- inst "$moddir/fips.sh" /sbin/fips.sh
+ inst_hook pre-udev 01 "$moddir/fips-load-crypto.sh"
+ inst_script "$moddir/fips.sh" /sbin/fips.sh
- dracut_install sha512hmac rmmod insmod mount uname umount
+ inst_multiple sha512hmac rmmod insmod mount uname umount
- for dir in "$usrlibdir" "$libdir"; do
- [[ -e $dir/libsoftokn3.so ]] && \
- dracut_install $dir/libsoftokn3.so $dir/libsoftokn3.chk \
- $dir/libfreebl3.so $dir/libfreebl3.chk && \
- break
- done
-
- dracut_install $usrlibdir/hmaccalc/sha512hmac.hmac
- if command -v prelink >/dev/null; then
- dracut_install prelink
- fi
+ inst_simple /etc/system-fips
+ [ -c ${initdir}/dev/random ] || mknod ${initdir}/dev/random c 1 8 \
+ || {
+ dfatal "Cannot create /dev/random"
+ dfatal "To create an initramfs with fips support, dracut has to run as root"
+ return 1
+ }
+ [ -c ${initdir}/dev/urandom ] || mknod ${initdir}/dev/urandom c 1 9 \
+ || {
+ dfatal "Cannot create /dev/random"
+ dfatal "To create an initramfs with fips support, dracut has to run as root"
+ return 1
+ }
}
-