From: Lukas Nykryn <lnykryn@redhat.com>
Date: Tue, 14 May 2019 07:23:55 +0000 (+0200)
Subject: fips: split loading the crypto modules and checking the kernel
X-Git-Tag: 050~181
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b988934a385e29547b44d1ab35442f53d134d62e;p=thirdparty%2Fdracut.git

fips: split loading the crypto modules and checking the kernel

In e54ab383 we moved the fips script to a later pahse of boot, since
the /boot might not be available early on.

The problem is that systemd-cryptsetup* services could be run now
started before the do_fips is executed and need the crypto modules
to decrypted the devices.

So let's split the do_fips and load the module before udev does the
trigger.
---

diff --git a/modules.d/01fips/fips-load-crypto.sh b/modules.d/01fips/fips-load-crypto.sh
new file mode 100644
index 000000000..82cbeee42
--- /dev/null
+++ b/modules.d/01fips/fips-load-crypto.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then
+    rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1
+else
+    . /sbin/fips.sh
+    fips_load_crypto || die "FIPS integrity test failed"
+fi
diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
index c6c986cf7..c6de30839 100755
--- a/modules.d/01fips/fips.sh
+++ b/modules.d/01fips/fips.sh
@@ -69,15 +69,8 @@ do_rhevh_check()
     return 0
 }
 
-do_fips()
+fips_load_crypto()
 {
-    local _v
-    local _s
-    local _v
-    local _module
-
-    KERNEL=$(uname -r)
-
     FIPSMODULES=$(cat /etc/fipsmodules)
 
     info "Loading and integrity checking all crypto modules"
@@ -102,6 +95,16 @@ do_fips()
     info "Self testing crypto algorithms"
     modprobe tcrypt || return 1
     rmmod tcrypt
+}
+
+do_fips()
+{
+    local _v
+    local _s
+    local _v
+    local _module
+
+    KERNEL=$(uname -r)
 
     info "Checking integrity of kernel"
     if [ -e "/run/initramfs/live/vmlinuz0" ]; then
diff --git a/modules.d/01fips/module-setup.sh b/modules.d/01fips/module-setup.sh
index dcceb1710..a792f5494 100755
--- a/modules.d/01fips/module-setup.sh
+++ b/modules.d/01fips/module-setup.sh
@@ -64,6 +64,7 @@ install() {
     local _dir
     inst_hook pre-mount 01 "$moddir/fips-boot.sh"
     inst_hook pre-pivot 01 "$moddir/fips-noboot.sh"
+    inst_hook pre-udev 01 "$moddir/fips-load-crypto.sh"
     inst_script "$moddir/fips.sh" /sbin/fips.sh
 
     inst_multiple sha512hmac rmmod insmod mount uname umount