Bug 1730896

Description of problem:When fips=1 in enabled on a server, and the server is booted into the generated rescue kernel entry, created by the dracut-config-rescue package. It will fail to boot since there isn't an hmac file for the rescue vmlinuz file.


Steps to Reproduce:
1. Install dracut-config-rescue, and install a kernel.
2. Enable fips=1 and try to boot into the generated rescue kernel.


Actual results:
[    5.208328] dracut: FATAL: FIPS integrity test failed
[    4.135472] dracut-pre-trigger[303]: Warning: /boot//.vmlinuz-0-rescue-940ca953abe70648a79ff135488faa65.hmac does not exist
[    5.213085] dracut: Refusing to continue
[    5.259004] systemd-shutdown[1]: Syncing filesystems and block devices.
[    5.262052] systemd-shutdown[1]: Sending SIGTERM to remaining processes...
[    5.275614] systemd-journald[104]: Received SIGTERM from PID 1 (systemd-shutdow).
[    5.281783] systemd-shutdown[1]: Sending SIGKILL to remaining processes...
[    5.290363] systemd-shutdown[1]: Unmounting file systems.
[    5.293187] systemd-shutdown[842]: Remounting '/boot' read-only in with options 'attr2,inode64,noquota'.
[    5.297106] systemd-shutdown[843]: Unmounting '/boot'.
[    5.302889] XFS (vda1): Unmounting Filesystem
[    5.308530] systemd-shutdown[844]: Remounting '/var/lib/nfs/rpc_pipefs' read-only in with options ''.
[    5.312126] systemd-shutdown[845]: Unmounting '/var/lib/nfs/rpc_pipefs'.
[    5.320073] systemd-shutdown[846]: Remounting '/' read-only in with options ''.
[    5.323103] systemd-shutdown[847]: Remounting '/' read-only in with options ''.
[    5.326387] systemd-shutdown[1]: All filesystems unmounted.
[    5.328598] systemd-shutdown[1]: Deactivating swaps.
[    5.330732] systemd-shutdown[1]: All swaps deactivated.
[    5.333400] systemd-shutdown[1]: Detaching loop devices.
[    5.335852] systemd-shutdown[1]: All loop devices detached.
[    5.338594] systemd-shutdown[1]: Detaching DM devices.
[    5.341373] systemd-shutdown[1]: All DM devices detached.
[    5.344509] systemd-shutdown[1]: Syncing filesystems and block devices.
[    5.347613] systemd-shutdown[1]: Halting system.
[    5.353328] System halted.


Expected results:
[    4.402737] dracut-pre-trigger[305]: /boot/vmlinuz-0-rescue-940ca953abe70648a79ff135488faa65: OK
[    5.237294] XFS (vda1): Unmounting Filesystem
[  OK  ] Started dracut pre-trigger hook.


Additional info:
- This also affects RHEL 8.
- I threw together the below patch that should create the hmac file on any new kernel install if the hmaccalc package is installed. Since the file is only needed for fips installs, only generate it for them. I set it up to use the sha512hmac to generate the hmac in case the original kernel that they rescue kernel was created from doesn't exist anymore. I'm not sure if this is the best way to fix the problem

# diff -up /etc/kernel/postinst.d/51-dracut-rescue-postinst.sh.old /etc/kernel/postinst.d/51-dracut-rescue-postinst.sh
--- /etc/kernel/postinst.d/51-dracut-rescue-postinst.sh.old	2018-09-27 09:47:05.000000000 -0400
+++ /etc/kernel/postinst.d/51-dracut-rescue-postinst.sh	2019-07-17 15:25:51.861383249 -0400
@@ -20,8 +20,15 @@ fi
 
 INITRDFILE="/boot/initramfs-0-rescue-${MACHINE_ID}.img"
 NEW_KERNEL_IMAGE="${KERNEL_IMAGE%/*}/vmlinuz-0-rescue-${MACHINE_ID}"
+NEW_KERNEL_HMAC="${KERNEL_IMAGE%/*}/.vmlinuz-0-rescue-${MACHINE_ID}.hmac"
 
-[[ -f $INITRDFILE ]] && [[ -f $NEW_KERNEL_IMAGE ]] && exit 0
+if [[ -f $INITRDFILE ]] && [[ -f $NEW_KERNEL_IMAGE ]]; then
+   if [[ -f $NEW_KERNEL_HMAC ]]; then
+      exit 0
+   elif [[ ! -f '/usr/bin/sha512hmac' ]]; then
+      exit 0
+   fi
+fi
 
 dropindirs_sort()
 {
@@ -63,8 +70,14 @@ if [[ ! -f $NEW_KERNEL_IMAGE ]]; then
     ((ret+=$?))
 fi
 
-new-kernel-pkg --install "$KERNEL_VERSION" --kernel-image "$NEW_KERNEL_IMAGE" --initrdfile "$INITRDFILE" --banner "$NAME $VERSION_ID Rescue $MACHINE_ID"
+if [[ ! -f $NEW_KERNEL_HMAC ]] && [[ -f '/usr/bin/sha512hmac' ]]; then
+    sha512hmac "$NEW_KERNEL_IMAGE" > "$NEW_KERNEL_HMAC"
+    ((ret+=$?))
+fi
 
-((ret+=$?))
+if [[ ! $(grep -r Rescue /boot/) ]]; then
+   new-kernel-pkg --install "$KERNEL_VERSION" --kernel-image "$NEW_KERNEL_IMAGE" --initrdfile "$INITRDFILE" --banner "$NAME $VERSION_ID Rescue $MACHINE_ID"
+   ((ret+=$?))
+fi
 
 exit $ret