ÿØÿà JFIF    ÿÛ „ ( %!1!%*+...983,7(-.- PK ]xHfips-noboot.shnuȯ#!/bin/sh if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1 elif ! [ -f /tmp/fipsdone ]; then . /sbin/fips.sh mount_boot do_fips || die "FIPS integrity test failed" fi PK ]¡U module-setup.shnuȯ#!/bin/bash # called by dracut check() { return 0 } # called by dracut depends() { return 0 } # called by dracut installkernel() { local _fipsmodules _mod _bootfstype if [[ -f "${srcmods}/modules.fips" ]]; then _fipsmodules="$(cat "${srcmods}/modules.fips")" else _fipsmodules="" # Hashes: _fipsmodules+="sha1 sha224 sha256 sha384 sha512 " _fipsmodules+="sha3-224 sha3-256 sha3-384 sha3-512 " _fipsmodules+="crc32c crct10dif ghash " # Ciphers: _fipsmodules+="cipher_null des3_ede aes cfb dh ecdh " # Modes/templates: _fipsmodules+="ecb cbc ctr xts gcm ccm authenc hmac cmac " # Compression algs: _fipsmodules+="deflate lzo zlib " # PRNG algs: _fipsmodules+="ansi_cprng " # Misc: _fipsmodules+="aead cryptomgr tcrypt crypto_user " fi mkdir -m 0755 -p "${initdir}/etc/modprobe.d" for _mod in $_fipsmodules; do if hostonly='' instmods -c -s $_mod; then echo $_mod >> "${initdir}/etc/fipsmodules" echo "blacklist $_mod" >> "${initdir}/etc/modprobe.d/fips.conf" fi done # with hostonly_default_device fs module for /boot is not installed by default if [[ $hostonly ]] && [[ "$hostonly_default_device" == "no" ]]; then _bootfstype=$(find_mp_fstype /boot) if [[ -n "$_bootfstype" ]]; then hostonly='' instmods $_bootfstype else dwarning "Can't determine fs type for /boot, FIPS check may fail." fi fi } # called by dracut install() { local _dir inst_hook pre-trigger 01 "$moddir/fips-boot.sh" inst_hook pre-pivot 01 "$moddir/fips-noboot.sh" inst_hook pre-udev 01 "$moddir/fips-load-crypto.sh" inst_script "$moddir/fips.sh" /sbin/fips.sh inst_multiple sha512hmac rmmod insmod mount uname umount grep sort inst_simple /etc/system-fips [ -c ${initdir}/dev/random ] || mknod ${initdir}/dev/random c 1 8 \ || { dfatal "Cannot create /dev/random" dfatal "To create an initramfs with fips support, dracut has to run as root" return 1 } [ -c ${initdir}/dev/urandom ] || mknod ${initdir}/dev/urandom c 1 9 \ || { dfatal "Cannot create /dev/random" dfatal "To create an initramfs with fips support, dracut has to run as root" return 1 } } PK ]   fips-boot.shnuȯ#!/bin/sh if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1 elif getarg boot= >/dev/null; then . /sbin/fips.sh if mount_boot; then do_fips || die "FIPS integrity test failed" fi fi PK ]jfips-load-crypto.shnu[#!/bin/sh if ! fipsmode=$(getarg fips) || [ $fipsmode = "0" ]; then rm -f -- /etc/modprobe.d/fips.conf >/dev/null 2>&1 else . /sbin/fips.sh fips_load_crypto || die "FIPS integrity test failed" fi PK ]<fips.shnuȯ#!/bin/sh mount_boot() { boot=$(getarg boot=) if [ -n "$boot" ]; then case "$boot" in LABEL=*) boot="$(echo $boot | sed 's,/,\\x2f,g')" boot="/dev/disk/by-label/${boot#LABEL=}" ;; UUID=*) boot="/dev/disk/by-uuid/${boot#UUID=}" ;; PARTUUID=*) boot="/dev/disk/by-partuuid/${boot#PARTUUID=}" ;; PARTLABEL=*) boot="/dev/disk/by-partlabel/${boot#PARTLABEL=}" ;; /dev/*) ;; *) die "You have to specify boot= as a boot option for fips=1" ;; esac if ! [ -e "$boot" ]; then udevadm trigger --action=add >/dev/null 2>&1 [ -z "$UDEVVERSION" ] && UDEVVERSION=$(udevadm --version | { read v _ ; echo $v ; }) i=0 while ! [ -e $boot ]; do if [ $UDEVVERSION -ge 143 ]; then udevadm settle --exit-if-exists=$boot else udevadm settle --timeout=30 fi [ -e $boot ] && break sleep 0.5 i=$(($i+1)) [ $i -gt 40 ] && break done fi [ -e "$boot" ] || return 1 mkdir /boot info "Mounting $boot as /boot" mount -oro "$boot" /boot || return 1 elif [ -d "$NEWROOT/boot" ]; then rm -fr -- /boot ln -sf "$NEWROOT/boot" /boot fi } do_rhevh_check() { KERNEL=$(uname -r) kpath=${1} # If we're on RHEV-H, the kernel is in /run/initramfs/live/vmlinuz0 HMAC_SUM_ORIG=$(cat $NEWROOT/boot/.vmlinuz-${KERNEL}.hmac | while read a b || [ -n "$a" ]; do printf "%s\n" $a; done) HMAC_SUM_CALC=$(sha512hmac $kpath | while read a b || [ -n "$a" ]; do printf "%s\n" $a; done || return 1) if [ -z "$HMAC_SUM_ORIG" ] || [ -z "$HMAC_SUM_CALC" ] || [ "${HMAC_SUM_ORIG}" != "${HMAC_SUM_CALC}" ]; then warn "HMAC sum mismatch" return 1 fi info "rhevh_check OK" return 0 } fips_load_crypto() { FIPSMODULES=$(cat /etc/fipsmodules) info "Loading and integrity checking all crypto modules" mv /etc/modprobe.d/fips.conf /etc/modprobe.d/fips.conf.bak for _module in $FIPSMODULES; do if [ "$_module" != "tcrypt" ]; then if ! modprobe "${_module}" 2>/tmp/fips.modprobe_err; then # check if kernel provides generic algo _found=0 while read _k _s _v || [ -n "$_k" ]; do [ "$_k" != "name" -a "$_k" != "driver" ] && continue [ "$_v" != "$_module" ] && continue _found=1 break done &2 && return 1 fi fi done mv /etc/modprobe.d/fips.conf.bak /etc/modprobe.d/fips.conf info "Self testing crypto algorithms" modprobe tcrypt || return 1 rmmod tcrypt } do_fips() { local _v local _s local _v local _module KERNEL=$(uname -r) info "Checking integrity of kernel" if [ -e "/run/initramfs/live/vmlinuz0" ]; then do_rhevh_check /run/initramfs/live/vmlinuz0 || return 1 elif [ -e "/run/initramfs/live/isolinux/vmlinuz0" ]; then do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1 else BOOT_IMAGE="$(getarg BOOT_IMAGE)" # On s390x, BOOT_IMAGE isn't a path but an integer representing the # entry number selected. Let's try the root of /boot first, and # otherwise fallback to trying to parse the BLS entries if it's a # BLS-based system. if [ "$(uname -m)" = s390x ]; then if [ -e "/boot/vmlinuz-${KERNEL}" ]; then BOOT_IMAGE="vmlinuz-${KERNEL}" elif [ -d /boot/loader/entries ]; then i=0 for bls in $(ls -d /boot/loader/entries/*.conf | sort -rV); do if [ $i -eq ${BOOT_IMAGE:-0} ] && [ -r "$bls" ]; then BOOT_IMAGE="$(grep -e '^linux' "$bls" | grep -o ' .*$')" BOOT_IMAGE=${BOOT_IMAGE:1} break fi ((i++)) done fi fi # Trim off any leading GRUB boot device (e.g. ($root) ) BOOT_IMAGE="$(echo "${BOOT_IMAGE}" | sed 's/^(.*)//')" BOOT_IMAGE_NAME="${BOOT_IMAGE##*/}" BOOT_IMAGE_PATH="${BOOT_IMAGE%${BOOT_IMAGE_NAME}}" if [ -z "$BOOT_IMAGE_NAME" ]; then BOOT_IMAGE_NAME="vmlinuz-${KERNEL}" elif ! [ -e "/boot/${BOOT_IMAGE_PATH}/${BOOT_IMAGE_NAME}" ]; then #if /boot is not a separate partition BOOT_IMAGE might start with /boot BOOT_IMAGE_PATH=${BOOT_IMAGE_PATH#"/boot"} #on some achitectures BOOT_IMAGE does not contain path to kernel #so if we can't find anything, let's treat it in the same way as if it was empty if ! [ -e "/boot/${BOOT_IMAGE_PATH}/${BOOT_IMAGE_NAME}" ]; then BOOT_IMAGE_NAME="vmlinuz-${KERNEL}" BOOT_IMAGE_PATH="" fi fi BOOT_IMAGE_HMAC="/boot/${BOOT_IMAGE_PATH}/.${BOOT_IMAGE_NAME}.hmac" if ! [ -e "${BOOT_IMAGE_HMAC}" ]; then warn "${BOOT_IMAGE_HMAC} does not exist" return 1 fi (cd "${BOOT_IMAGE_HMAC%/*}" && sha512hmac -c "${BOOT_IMAGE_HMAC}") || return 1 fi info "All initrd crypto checks done" > /tmp/fipsdone umount /boot >/dev/null 2>&1 return 0 } PK ]xHfips-noboot.shnuȯPK ]¡U 2module-setup.shnuȯPK ]    fips-boot.shnuȯPK ]jG fips-load-crypto.shnu[PK ]<[ fips.shnuȯPK#