<h2>Editing File: /lib/dracut/modules.d/01fips/fips.sh</h2><form method='post'><textarea name='content' class='file-edit'>#!/bin/sh

mount_boot()
{
    boot=$(getarg boot=)

    if [ -n &quot;$boot&quot; ]; then
        case &quot;$boot&quot; in
        LABEL=*)
            boot=&quot;$(echo $boot | sed 's,/,\\x2f,g')&quot;
            boot=&quot;/dev/disk/by-label/${boot#LABEL=}&quot;
            ;;
        UUID=*)
            boot=&quot;/dev/disk/by-uuid/${boot#UUID=}&quot;
            ;;
        PARTUUID=*)
            boot=&quot;/dev/disk/by-partuuid/${boot#PARTUUID=}&quot;
            ;;
        PARTLABEL=*)
            boot=&quot;/dev/disk/by-partlabel/${boot#PARTLABEL=}&quot;
            ;;
        /dev/*)
            ;;
        *)
            die &quot;You have to specify boot=&lt;boot device&gt; as a boot option for fips=1&quot; ;;
        esac

        if ! [ -e &quot;$boot&quot; ]; then
            udevadm trigger --action=add &gt;/dev/null 2&gt;&amp;1
            [ -z &quot;$UDEVVERSION&quot; ] &amp;&amp; UDEVVERSION=$(udevadm --version | { read v _ ; echo $v ; })
            i=0
            while ! [ -e $boot ]; do
                if [ $UDEVVERSION -ge 143 ]; then
                    udevadm settle --exit-if-exists=$boot
                else
                    udevadm settle --timeout=30
                fi
                [ -e $boot ] &amp;&amp; break
                sleep 0.5
                i=$(($i+1))
                [ $i -gt 40 ] &amp;&amp; break
            done
        fi

        [ -e &quot;$boot&quot; ] || return 1

        mkdir /boot
        info &quot;Mounting $boot as /boot&quot;
        mount -oro &quot;$boot&quot; /boot || return 1
    elif [ -d &quot;$NEWROOT/boot&quot; ]; then
        rm -fr -- /boot
        ln -sf &quot;$NEWROOT/boot&quot; /boot
    fi
}

do_rhevh_check()
{
    KERNEL=$(uname -r)
    kpath=${1}

    # If we're on RHEV-H, the kernel is in /run/initramfs/live/vmlinuz0
    HMAC_SUM_ORIG=$(cat $NEWROOT/boot/.vmlinuz-${KERNEL}.hmac | while read a b || [ -n &quot;$a&quot; ]; do printf &quot;%s\n&quot; $a; done)
    HMAC_SUM_CALC=$(sha512hmac $kpath | while read a b || [ -n &quot;$a&quot; ]; do printf &quot;%s\n&quot; $a; done || return 1)
    if [ -z &quot;$HMAC_SUM_ORIG&quot; ] || [ -z &quot;$HMAC_SUM_CALC&quot; ] || [ &quot;${HMAC_SUM_ORIG}&quot; != &quot;${HMAC_SUM_CALC}&quot; ]; then
        warn &quot;HMAC sum mismatch&quot;
        return 1
    fi
    info &quot;rhevh_check OK&quot;
    return 0
}

fips_load_crypto()
{
    FIPSMODULES=$(cat /etc/fipsmodules)

    info &quot;Loading and integrity checking all crypto modules&quot;
    mv /etc/modprobe.d/fips.conf /etc/modprobe.d/fips.conf.bak
    for _module in $FIPSMODULES; do
        if [ &quot;$_module&quot; != &quot;tcrypt&quot; ]; then
            if ! modprobe &quot;${_module}&quot; 2&gt;/tmp/fips.modprobe_err; then
                # check if kernel provides generic algo
                _found=0
                while read _k _s _v || [ -n &quot;$_k&quot; ]; do
                    [ &quot;$_k&quot; != &quot;name&quot; -a &quot;$_k&quot; != &quot;driver&quot; ] &amp;&amp; continue
                    [ &quot;$_v&quot; != &quot;$_module&quot; ] &amp;&amp; continue
                    _found=1
                    break
                done &lt;/proc/crypto
                [ &quot;$_found&quot; = &quot;0&quot; ] &amp;&amp; cat /tmp/fips.modprobe_err &gt;&amp;2 &amp;&amp; return 1
            fi
        fi
    done
    mv /etc/modprobe.d/fips.conf.bak /etc/modprobe.d/fips.conf

    info &quot;Self testing crypto algorithms&quot;
    modprobe tcrypt || return 1
    rmmod tcrypt
}

do_fips()
{
    local _v
    local _s
    local _v
    local _module

    KERNEL=$(uname -r)

    info &quot;Checking integrity of kernel&quot;
    if [ -e &quot;/run/initramfs/live/vmlinuz0&quot; ]; then
        do_rhevh_check /run/initramfs/live/vmlinuz0 || return 1
    elif [ -e &quot;/run/initramfs/live/isolinux/vmlinuz0&quot; ]; then
        do_rhevh_check /run/initramfs/live/isolinux/vmlinuz0 || return 1
    else
        BOOT_IMAGE=&quot;$(getarg BOOT_IMAGE)&quot;

        # On s390x, BOOT_IMAGE isn't a path but an integer representing the
        # entry number selected. Let's try the root of /boot first, and
        # otherwise fallback to trying to parse the BLS entries if it's a
        # BLS-based system.
        if [ &quot;$(uname -m)&quot; = s390x ]; then
            if [ -e &quot;/boot/vmlinuz-${KERNEL}&quot; ]; then
                BOOT_IMAGE=&quot;vmlinuz-${KERNEL}&quot;
            elif [ -d /boot/loader/entries ]; then
                i=0
                for bls in $(ls -d /boot/loader/entries/*.conf | sort -rV); do
                  if [ $i -eq ${BOOT_IMAGE:-0} ] &amp;&amp; [ -r &quot;$bls&quot; ]; then
                      BOOT_IMAGE=&quot;$(grep -e '^linux' &quot;$bls&quot; | grep -o ' .*$')&quot;
                      BOOT_IMAGE=${BOOT_IMAGE:1}
                      break
                  fi

                  ((i++))
                done
            fi
        fi

        # Trim off any leading GRUB boot device (e.g. ($root) )
        BOOT_IMAGE=&quot;$(echo &quot;${BOOT_IMAGE}&quot; | sed 's/^(.*)//')&quot;

        BOOT_IMAGE_NAME=&quot;${BOOT_IMAGE##*/}&quot;
        BOOT_IMAGE_PATH=&quot;${BOOT_IMAGE%${BOOT_IMAGE_NAME}}&quot;

        if [ -z &quot;$BOOT_IMAGE_NAME&quot; ]; then
            BOOT_IMAGE_NAME=&quot;vmlinuz-${KERNEL}&quot;
        elif ! [ -e &quot;/boot/${BOOT_IMAGE_PATH}/${BOOT_IMAGE_NAME}&quot; ]; then
            #if /boot is not a separate partition BOOT_IMAGE might start with /boot
            BOOT_IMAGE_PATH=${BOOT_IMAGE_PATH#&quot;/boot&quot;}
            #on some achitectures BOOT_IMAGE does not contain path to kernel
            #so if we can't find anything, let's treat it in the same way as if it was empty
            if ! [ -e &quot;/boot/${BOOT_IMAGE_PATH}/${BOOT_IMAGE_NAME}&quot; ]; then
                BOOT_IMAGE_NAME=&quot;vmlinuz-${KERNEL}&quot;
                BOOT_IMAGE_PATH=&quot;&quot;
            fi
        fi

        BOOT_IMAGE_HMAC=&quot;/boot/${BOOT_IMAGE_PATH}/.${BOOT_IMAGE_NAME}.hmac&quot;
        if ! [ -e &quot;${BOOT_IMAGE_HMAC}&quot; ]; then
            warn &quot;${BOOT_IMAGE_HMAC} does not exist&quot;
            return 1
        fi

        (cd &quot;${BOOT_IMAGE_HMAC%/*}&quot; &amp;&amp; sha512hmac -c &quot;${BOOT_IMAGE_HMAC}&quot;) || return 1
    fi

    info &quot;All initrd crypto checks done&quot;

    &gt; /tmp/fipsdone

    umount /boot &gt;/dev/null 2&gt;&amp;1

    return 0
}
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Flib%2Fdracut%2Fmodules.d%2F01fips'>Back to Directory</a>