fix(fips): shellcheck for modules.d/01fips

diff --git a/modules.d/01fips/.shchkdir b/modules.d/01fips/.shchkdir
new file mode 100644 (file)
index 0000000..e69de29

diff --git a/modules.d/01fips/fips-boot.sh b/modules.d/01fips/fips-boot.sh
index 3eaef6751a5d7813bb6fbe8423afe6308a97be46..031d169a6946f0387ac6846444fb943f956156cd 100755 (executable)
--- a/modules.d/01fips/fips-boot.sh
+++ b/modules.d/01fips/fips-boot.sh
@@ -1,5 +1,7 @@
 #!/bin/sh
 
+type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
+
 if ! fipsmode=$(getarg fips) || [ "$fipsmode" = "0" ]; then
     rm -f -- /etc/modprobe.d/fips.conf > /dev/null 2>&1
 elif [ -z "$fipsmode" ]; then

diff --git a/modules.d/01fips/fips-load-crypto.sh b/modules.d/01fips/fips-load-crypto.sh
index 23d48a6a35ce573758863a07c54fb36bc71a0f1a..21e99278592720e7f27ce819dd58e0559751ad3f 100644 (file)
--- a/modules.d/01fips/fips-load-crypto.sh
+++ b/modules.d/01fips/fips-load-crypto.sh
@@ -1,7 +1,11 @@
 #!/bin/sh
 
-if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then
+type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
+
+if ! fipsmode=$(getarg fips) || [ "$fipsmode" = "0" ]; then
     rm -f -- /etc/modprobe.d/fips.conf > /dev/null 2>&1
+elif [ -z "$fipsmode" ]; then
+    die "FIPS mode have to be enabled by 'fips=1' not just 'fips'"
 else
     . /sbin/fips.sh
     fips_load_crypto || die "FIPS integrity test failed"

diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
index b4e3db666aba20ba65036019950159b6e980136e..d293b224e141eaaaa848985f1c687690a49310b6 100755 (executable)
--- a/modules.d/01fips/fips.sh
+++ b/modules.d/01fips/fips.sh
@@ -1,5 +1,7 @@
 #!/bin/sh
 
+type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh
+
 # systemd lets stdout go to journal only, but the system
 # has to halt when the integrity check fails to satisfy FIPS.
 if [ -z "$DRACUT_SYSTEMD" ]; then
@@ -31,13 +33,13 @@ mount_boot() {
             udevadm trigger --action=add > /dev/null 2>&1
             [ -z "$UDEVVERSION" ] && UDEVVERSION=$(udevadm --version)
             i=0
-            while ! [ -e $boot ]; do
-                if [ $UDEVVERSION -ge 143 ]; then
-                    udevadm settle --exit-if-exists=$boot
+            while ! [ -e "$boot" ]; do
+                if [ "$UDEVVERSION" -ge 143 ]; then
+                    udevadm settle --exit-if-exists="$boot"
                 else
                     udevadm settle --timeout=30
                 fi
-                [ -e $boot ] && break
+                [ -e "$boot" ] && break
                 sleep 0.5
                 i=$((i + 1))
                 [ $i -gt 40 ] && break
@@ -50,6 +52,7 @@ mount_boot() {
         fips_info "Mounting $boot as /boot"
         mount -oro "$boot" /boot || return 1
     elif [ -d "$NEWROOT/boot" ]; then
+        # shellcheck disable=SC2114
         rm -fr -- /boot
         ln -sf "$NEWROOT/boot" /boot
     fi
@@ -60,8 +63,8 @@ do_rhevh_check() {
     kpath=${1}
 
     # If we're on RHEV-H, the kernel is in /run/initramfs/live/vmlinuz0
-    HMAC_SUM_ORIG=$(cat $NEWROOT/boot/.vmlinuz-${KERNEL}.hmac | while read a b || [ -n "$a" ]; do printf "%s\n" $a; done)
-    HMAC_SUM_CALC=$(sha512hmac $kpath | while read a b || [ -n "$a" ]; do printf "%s\n" $a; done || return 1)
+    HMAC_SUM_ORIG=$(while read -r a _ || [ -n "$a" ]; do printf "%s\n" "$a"; done < "$NEWROOT/boot/.vmlinuz-${KERNEL}.hmac")
+    HMAC_SUM_CALC=$(sha512hmac "$kpath" | while read -r a _ || [ -n "$a" ]; do printf "%s\n" "$a"; done || return 1)
     if [ -z "$HMAC_SUM_ORIG" ] || [ -z "$HMAC_SUM_CALC" ] || [ "${HMAC_SUM_ORIG}" != "${HMAC_SUM_CALC}" ]; then
         warn "HMAC sum mismatch"
         return 1
@@ -71,13 +74,17 @@ do_rhevh_check() {
 }
 
 nonfatal_modprobe() {
-    modprobe $1 2>&1 > /dev/stdout \
+    modprobe "$1" 2>&1 > /dev/stdout \
         | while read -r line || [ -n "$line" ]; do
             echo "${line#modprobe: FATAL: }" >&2
         done
 }
 
 fips_load_crypto() {
+    local _k
+    local _v
+    local _found
+
     FIPSMODULES=$(cat /etc/fipsmodules)
 
     fips_info "Loading and integrity checking all crypto modules"
@@ -87,7 +94,7 @@ fips_load_crypto() {
             if ! nonfatal_modprobe "${_module}" 2> /tmp/fips.modprobe_err; then
                 # check if kernel provides generic algo
                 _found=0
-                while read _k _s _v || [ -n "$_k" ]; do
+                while read -r _k _ _v || [ -n "$_k" ]; do
                     [ "$_k" != "name" -a "$_k" != "driver" ] && continue
                     [ "$_v" != "$_module" ] && continue
                     _found=1
@@ -105,8 +112,6 @@ fips_load_crypto() {
 }
 
 do_fips() {
-    local _v
-    local _s
     local _v
     local _module
 
@@ -153,7 +158,7 @@ do_fips() {
 
     fips_info "All initrd crypto checks done"
 
-    > /tmp/fipsdone
+    : > /tmp/fipsdone
 
     umount /boot > /dev/null 2>&1
 

diff --git a/modules.d/01fips/module-setup.sh b/modules.d/01fips/module-setup.sh
index 38485cfb75b69dc9a6bcee2fdffac0092c7cac3e..75fcc1b67a1415fe95e09e5f479076d258fa9ef8 100755 (executable)
--- a/modules.d/01fips/module-setup.sh
+++ b/modules.d/01fips/module-setup.sh
@@ -39,11 +39,12 @@ installkernel() {
         _fipsmodules+="aead cryptomgr tcrypt crypto_user "
     fi
 
+    # shellcheck disable=SC2174
     mkdir -m 0755 -p "${initdir}/etc/modprobe.d"
 
     for _mod in $_fipsmodules; do
-        if hostonly='' instmods -c -s $_mod; then
-            echo $_mod >> "${initdir}/etc/fipsmodules"
+        if hostonly='' instmods -c -s "$_mod"; then
+            echo "$_mod" >> "${initdir}/etc/fipsmodules"
             echo "blacklist $_mod" >> "${initdir}/etc/modprobe.d/fips.conf"
         fi
     done
@@ -52,7 +53,7 @@ installkernel() {
     if [[ $hostonly ]] && [[ $hostonly_default_device == "no" ]]; then
         _bootfstype=$(find_mp_fstype /boot)
         if [[ -n $_bootfstype ]]; then
-            hostonly='' instmods $_bootfstype
+            hostonly='' instmods "$_bootfstype"
         else
             dwarning "Can't determine fs type for /boot, FIPS check may fail."
         fi
@@ -61,7 +62,6 @@ installkernel() {
 
 # called by dracut
 install() {
-    local _dir
     inst_hook pre-mount 01 "$moddir/fips-boot.sh"
     inst_hook pre-pivot 01 "$moddir/fips-noboot.sh"
     inst_hook pre-udev 01 "$moddir/fips-load-crypto.sh"
@@ -70,13 +70,13 @@ install() {
     inst_multiple sha512hmac rmmod insmod mount uname umount
 
     inst_simple /etc/system-fips
-    [ -c ${initdir}/dev/random ] || mknod ${initdir}/dev/random c 1 8 \
+    [ -c "${initdir}"/dev/random ] || mknod "${initdir}"/dev/random c 1 8 \
         || {
             dfatal "Cannot create /dev/random"
             dfatal "To create an initramfs with fips support, dracut has to run as root"
             return 1
         }
-    [ -c ${initdir}/dev/urandom ] || mknod ${initdir}/dev/urandom c 1 9 \
+    [ -c "${initdir}"/dev/urandom ] || mknod "${initdir}"/dev/urandom c 1 9 \
         || {
             dfatal "Cannot create /dev/random"
             dfatal "To create an initramfs with fips support, dracut has to run as root"