From: Harald Hoyer <harald@redhat.com>
Date: Mon, 30 Jan 2017 08:20:55 +0000 (+0100)
Subject: fips: honor $BOOT_IMAGE variable for HMAC check of the kernel
X-Git-Tag: 045~31
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4693daa5fa7dddc6b35825831f35657cb66bd531;p=thirdparty%2Fdracut.git

fips: honor $BOOT_IMAGE variable for HMAC check of the kernel

https://bugzilla.redhat.com/show_bug.cgi?id=1415032
---

diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
index 6acdf62a5..1f84526ac 100755
--- a/modules.d/01fips/fips.sh
+++ b/modules.d/01fips/fips.sh
@@ -77,9 +77,10 @@ do_fips()
     local _module
 
     KERNEL=$(uname -r)
-
-    if ! [ -e "/boot/.vmlinuz-${KERNEL}.hmac" ]; then
-        warn "/boot/.vmlinuz-${KERNEL}.hmac does not exist"
+    BOOT_IMAGE="$(getarg BOOT_IMAGE)"
+    BOOT_IMAGE="${BOOT_IMAGE:-/vmlinuz-${KERNEL}}"
+    if ! [ -e "/boot/.${BOOT_IMAGE}.hmac" ] && ! [ -e "/boot/.vmlinuz-${KERNEL}.hmac" ]; then
+        warn "/boot/.${BOOT_IMAGE}.hmac does not exist"
         return 1
     fi
 
@@ -114,7 +115,7 @@ do_fips()
     elif [ -e "/run/initramfs/live/isolinux/vmlinuz0" ]; then
         do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1
     else
-        sha512hmac -c "/boot/.vmlinuz-${KERNEL}.hmac" || return 1
+        sha512hmac -c "/boot/.${BOOT_IMAGE}.hmac" || return 1
     fi
 
     info "All initrd crypto checks done"