fips: fix RHEV vmlinuz check

diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
index 98dd1c2fef742450d49a35584c3dc6f0da3f8da9..7fa48f138aa298c756790cf48900a85776b56f88 100755 (executable)
--- a/modules.d/01fips/fips.sh
+++ b/modules.d/01fips/fips.sh
@@ -60,8 +60,8 @@ do_rhevh_check()
     KERNEL=$(uname -r)
     kpath=${1}
 
-    # If we're on RHEV-H, the kernel is in /dev/.initramfs/live/vmlinuz0
-    HMAC_SUM_ORIG=$(cat /boot/.vmlinuz-${KERNEL}.hmac | while read a b; do printf "%s\n" $a; done)
+    # If we're on RHEV-H, the kernel is in /run/initramfs/live/vmlinuz0
+    HMAC_SUM_ORIG=$(cat $NEWROOT/boot/.vmlinuz-${KERNEL}.hmac | while read a b; do printf "%s\n" $a; done)
     HMAC_SUM_CALC=$(sha512hmac $kpath | while read a b; do printf "%s\n" $a; done || return 1)
     if [ -z "$HMAC_SUM_ORIG" ] || [ -z "$HMAC_SUM_CALC" ] || [ "${HMAC_SUM_ORIG}" != "${HMAC_SUM_CALC}" ]; then
         warn "HMAC sum mismatch"
@@ -111,10 +111,10 @@ do_fips()
     rmmod tcrypt
 
     info "Checking integrity of kernel"
-    if [ -e "$NEWROOT/dev/.initramfs/live/vmlinuz0" ]; then
-        do_rhevh_check "$NEWROOT/dev/.initramfs/live/vmlinuz0" || return 1
-    elif [ -e "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" ]; then
-        do_rhevh_check "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" || return 1
+    if [ -e "/run/initramfs/live/vmlinuz0" ]; then
+        do_rhevh_check /run/initramfs/live/vmlinuz0 || return 1
+    elif [ -e "/run/initramfs/live/isolinux/vmlinuz0" ]; then
+        do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1
     else
         sha512hmac -c "/boot/.vmlinuz-${KERNEL}.hmac" || return 1
     fi