Fix fips module list.

If dracut is build only with fips/fips-aesni (no crypto module),
FIPS mode fails because of missing GCM modules.

Just add proper modules to list (kernel have both maker as FIPS compliant already).

Signed-off-by: Milan Broz <mbroz@redhat.com>

diff --git a/modules.d/01fips/module-setup.sh b/modules.d/01fips/module-setup.sh
index 2d238fbdad986e140c81edb97597389d2855acf9..2517964aa7600c297248578cfdba04c0f9dfebed 100755 (executable)
--- a/modules.d/01fips/module-setup.sh
+++ b/modules.d/01fips/module-setup.sh
@@ -12,7 +12,7 @@ depends() {
 
 installkernel() {
     local _fipsmodules _mod
-    _fipsmodules="aead aes_generic xts aes-x86_64 ansi_cprng cbc ccm chainiv ctr"
+    _fipsmodules="aead aes_generic xts aes-x86_64 ansi_cprng cbc ccm chainiv ctr gcm ghash_generic"
     _fipsmodules+=" des deflate ecb eseqiv hmac seqiv sha256 sha256_generic sha512 sha512_generic"
     _fipsmodules+=" cryptomgr crypto_null tcrypt dm-mod dm-crypt"
 

diff --git a/modules.d/02fips-aesni/module-setup.sh b/modules.d/02fips-aesni/module-setup.sh
index f8fb705b32b259ff65f6a77690f2715797e311b6..fb4010df602c0d59861d582656630cb66733c82f 100755 (executable)
--- a/modules.d/02fips-aesni/module-setup.sh
+++ b/modules.d/02fips-aesni/module-setup.sh
@@ -12,7 +12,7 @@ depends() {
 
 installkernel() {
     local _fipsmodules _mod
-    _fipsmodules="aesni-intel"
+    _fipsmodules="aesni-intel ghash_clmulni_intel"
 
     mkdir -m 0755 -p "${initdir}/etc/modprobe.d"