0002 "p#!/usr/bin/sh type getarg > /dev/null 2>&1 || . /lib/dracut-lib.sh # systemd lets stdout go to journal only, but the system # has to halt when the integrity check fails to satisfy FIPS. if [ -z "$DRACUT_SYSTEMD" ]; then fips_info() { info "$*" } else fips_info() { echo "$*" >&2 } fi # Checks if a systemd-based UKI is running and ESP UUID is set is_uki() { [ -f /sys/firmware/efi/efivars/StubFeatures-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f ] \ && [ -f /sys/firmware/efi/efivars/LoaderDevicePartUUID-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f ] } mount_boot() { boot=$(getarg boot=) if is_uki && [ -z "$boot" ]; then # efivar file has 4 bytes header and contain UCS-2 data. Note, 'cat' is required # as sys/firmware/efi/efivars/ files are 'special' and don't allow 'seeking'. # shellcheck disable=SC2002 boot="PARTUUID=$(cat /sys/firmware/efi/efivars/LoaderDevicePartUUID-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f | tail -c +5 | tr -d '\0' | tr 'A-F' 'a-f')" fi if [ -n "$boot" ]; then if [ -d /boot ] && ismounted /boot; then boot_dev= if command -v findmnt > /dev/null; then boot_dev=$(findmnt -n -o SOURCE /boot) fi fips_info "Ignoring 'boot=$boot' as /boot is already mounted ${boot_dev:+"from '$boot_dev'"}" return 0 fi case "$boot" in LABEL=* | UUID=* | PARTUUID=* | PARTLABEL=*) boot="$(label_uuid_to_dev "$boot")" ;; /dev/*) ;; *) die "You have to specify boot= as a boot option for fips=1" ;; esac if ! [ -e "$boot" ]; then udevadm trigger --action=add > /dev/null 2>&1 i=0 while ! [ -e "$boot" ]; do udevadm settle --exit-if-exists="$boot" [ -e "$boot" ] && break sleep 0.5 i=$((i + 1)) [ $i -gt 40 ] && break done fi [ -e "$boot" ] || return 1 mkdir -p /boot fips_info "Mounting $boot as /boot" mount -oro "$boot" /boot || return 1 FIPS_MOUNTED_BOOT=1 elif ! ismounted /boot && [ -d "$NEWROOT/boot" ]; then # shellcheck disable=SC2114 rm -fr -- /boot ln -sf "$NEWROOT/boot" /boot else die "You have to specify boot= as a boot option for fips=1" fi } do_rhevh_check() { KERNEL=$(uname -r) kpath=${1} # If we're on RHEV-H, the kernel is in /run/initramfs/live/vmlinuz0 HMAC_SUM_ORIG=$(while read -r a _ || [ -n "$a" ]; do printf "%s\n" "$a"; done < "$NEWROOT/boot/.vmlinuz-${KERNEL}.hmac") HMAC_SUM_CALC=$(sha512hmac "$kpath" | while read -r a _ || [ -n "$a" ]; do printf "%s\n" "$a"; done || return 1) if [ -z "$HMAC_SUM_ORIG" ] || [ -z "$HMAC_SUM_CALC" ] || [ "${HMAC_SUM_ORIG}" != "${HMAC_SUM_CALC}" ]; then warn "HMAC sum mismatch" return 1 fi fips_info "rhevh_check OK" return 0 } do_uki_check() { local KVER local uki_checked=0 KVER="$(uname -r)" # UKI are placed in $ESP\EFI\Linux\-.efi if ! [ "$FIPS_MOUNTED_BOOT" = 1 ]; then warn "Failed to mount ESP for doing UKI integrity check" return 1 fi for UKIpath in /boot/EFI/Linux/*-"$KVER".efi; do # UKIs are installed to $ESP/EFI/Linux/-.efi # and in some cases (e.g. when the image is used as a template for creating new # VMs) entry-token-or-machine-id can change. To make sure the running UKI is # always checked, check all UKIs which match the 'uname -r' of the running kernel # and fail the whole check if any of the matching UKIs are corrupted. [ -r "$UKIpath" ] || break local UKI="${UKIpath##*/}" local UKIHMAC=."$UKI".hmac fips_info "checking $UKIHMAC" (cd /boot/EFI/Linux/ && sha512hmac -c "$UKIHMAC") || return 1