diff options
Diffstat (limited to '0033-fips-fix-RHEV-vmlinuz-check.patch')
| -rw-r--r-- | 0033-fips-fix-RHEV-vmlinuz-check.patch | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/0033-fips-fix-RHEV-vmlinuz-check.patch b/0033-fips-fix-RHEV-vmlinuz-check.patch new file mode 100644 index 0000000..6388de3 --- /dev/null +++ b/0033-fips-fix-RHEV-vmlinuz-check.patch @@ -0,0 +1,39 @@ +From 928da5744721842d3e02151323c3a1357baf0032 Mon Sep 17 00:00:00 2001 +From: Harald Hoyer <harald@redhat.com> +Date: Fri, 8 Nov 2013 15:06:18 +0100 +Subject: [PATCH] fips: fix RHEV vmlinuz check + +--- + modules.d/01fips/fips.sh | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh +index 98dd1c2..7fa48f1 100755 +--- a/modules.d/01fips/fips.sh ++++ b/modules.d/01fips/fips.sh +@@ -60,8 +60,8 @@ do_rhevh_check() + KERNEL=$(uname -r) + kpath=${1} + +- # If we're on RHEV-H, the kernel is in /dev/.initramfs/live/vmlinuz0 +- HMAC_SUM_ORIG=$(cat /boot/.vmlinuz-${KERNEL}.hmac | while read a b; do printf "%s\n" $a; done) ++ # If we're on RHEV-H, the kernel is in /run/initramfs/live/vmlinuz0 ++ HMAC_SUM_ORIG=$(cat $NEWROOT/boot/.vmlinuz-${KERNEL}.hmac | while read a b; do printf "%s\n" $a; done) + HMAC_SUM_CALC=$(sha512hmac $kpath | while read a b; do printf "%s\n" $a; done || return 1) + if [ -z "$HMAC_SUM_ORIG" ] || [ -z "$HMAC_SUM_CALC" ] || [ "${HMAC_SUM_ORIG}" != "${HMAC_SUM_CALC}" ]; then + warn "HMAC sum mismatch" +@@ -111,10 +111,10 @@ do_fips() + rmmod tcrypt + + info "Checking integrity of kernel" +- if [ -e "$NEWROOT/dev/.initramfs/live/vmlinuz0" ]; then +- do_rhevh_check "$NEWROOT/dev/.initramfs/live/vmlinuz0" || return 1 +- elif [ -e "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" ]; then +- do_rhevh_check "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" || return 1 ++ if [ -e "/run/initramfs/live/vmlinuz0" ]; then ++ do_rhevh_check /run/initramfs/live/vmlinuz0 || return 1 ++ elif [ -e "/run/initramfs/live/isolinux/vmlinuz0" ]; then ++ do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1 + else + sha512hmac -c "/boot/.vmlinuz-${KERNEL}.hmac" || return 1 + fi |