0x030000
  "   ˆl–ßi~”Ja,jq@†ãNÜdJbÑ¿ÉƒxAg¿Ç      #!/usr/bin/bash

umask 022

usage=0
enable_fips=
check=0
boot_config=1
err_if_disabled=0
fips_install_complete=0
output_text=1

is_ostree_system=0
if test -f /run/ostree-booted -o -d /ostree; then
    is_ostree_system=1
fi

enable2txt () {
	case "$1" in
		0)
			echo "disabled"
			;;
		1)
			echo "enabled"
			;;
	esac
}

cond_echo () {
	if test "$output_text" != 0;then
		echo "$@"
	fi
}

while test $# -ge 1 ; do
	case "$1" in
		--enable)
			enable_fips=1
			;;
		--disable)
			enable_fips=0
			;;
		--check)
			check=1
			enable_fips=2
			;;
		--is-enabled)
			check=1
			enable_fips=2
			err_if_disabled=1
			output_text=0
			;;
		--no-bootcfg)
			boot_config=0
			;;
		*)
			usage=1
			;;
	esac
	shift
done

if test $usage = 1 -o x$enable_fips = x ; then
	echo "Check, enable, or disable (unsupported) the system FIPS mode."
	echo "usage: $0 --enable|--disable [--no-bootcfg]"
	echo "usage: $0 --check"
	echo "usage: $0 --is-enabled"
	exit 2
fi

# We don't handle the boot config on OSTree systems for now; it is assumed to be
# handled at a higher level. E.g. in Fedora CoreOS and RHEL CoreOS, it is
# intrinsically tied to the firstboot procedure.
if test "$is_ostree_system" = 1 && test "$enable_fips" = 1 && test "$boot_config" = 1; then
    cond_echo "Cannot perform boot config changes on OSTree systems (use --no-bootcfg)"
    exit 1
fi

if test -f /etc/system-fips ; then
	# On OSTree systems, /etc/system-fips in the real root marks completion.
	if test ! -d /boot -o "$is_ostree_system" = 1 -o ! -x /usr/bin/lsinitrd -o x"$(/usr/bin/lsinitrd -f etc/system-fips 2>/dev/null || test $? = 2 && echo y)" != x ; then
		fips_install_complete=1
	fi
fi

if test $check = 1 ; then
	test $fips_install_complete = 0 && cond_echo "Installation of FIPS modules is not completed."
	fips_enabled=$(cat /proc/sys/crypto/fips_enabled)
	cond_echo "FIPS mode is $(enable2txt $fips_enabled)."
	if test "$fips_enabled" = 1 ; then
		if test $fips_install_complete = 0 ; then
			cond_echo "Inconsistent state detected."
			exit 1
		fi
		current="$(cat /etc/crypto-policies/state/current)"
		if test "$(echo $current | cut -f 1 -d :)" != "FIPS" ; then
			cond_echo -n "The current crypto policy ($current) "
			cond_echo -n 'neither is the FIPS policy '
			cond_echo 'nor is based on the FIPS policy.'
			cond_echo 'Inconsistent state detected.'
			exit 1
		fi
	else
		if test $fips_install_complete = 1 ; then
			cond_echo "Inconsistent state detected."
			exit 1
		fi
		current="$(cat /etc/crypto-policies/state/current)"
		if test "$(echo $current | cut -f 1 -d :)" == "FIPS" ; then
			cond_echo -n "The current crypto policy ($current) "
			cond_echo -n 'is based on the FIPS policy, '
			cond_echo 'but FIPS mode is not enabled.'
			cond_echo 'Inconsistent state detected.'
			exit 1
		fi
	fi
	if test "$fips_enabled" != 1 && test "$err_if_disabled" = 1;then
		exit 2
	fi
	exit 0
fi

if [ $(id -u) != 0 ]; then
	echo "You must be root to run $(basename $0)"
	exit 1
fi

# Boot configuration
if test "$boot_config" = 1 && test ! -x "$(command -v grubby)" ; then
	echo "The grubby command is missing, please configure the bootloader manually."
	boot_config=0
fi

if test "$boot_config" = 1 && test ! -d /boot ; then
	echo >&2 "/boot directory is missing, FIPS mode cannot be $(enable2txt $enable_fips)."
	echo >&2 "If you want to configure the bootloader manually, re-run with --no-bootcfg."
	exit 1
fi

if test "$boot_config" = 1 && test -z "$(ls -A /boot)" ; then
	echo >&2 "/boot directory is empty, FIPS mode cannot be $(enable2txt $enable_fips)."
	echo >&2 "If you want to configure the bootloader manually, re-run with --no-bootcfg."
	exit 1
fi

if test "$FIPS_MODE_SETUP_SKIP_ARGON2_CHECK" != 1 && \
		test -x "$(command -v cryptsetup)" ; then
	# Best-effort detection of LUKS Argon2 usage
	argon2_found=''
	# two redundant ways to list device names
	devs=$( (find /dev/mapper/ -type l -printf '%f\n'; \
		dmsetup ls --target crypt | cut -f1) \
		| sort -u)
		while IFS= read -r devname; do
			back=$(cryptsetup status "$devname" | \