Bug 700102

Summary: Add multipath to the list of limitations of mkinitrd's FIPS support in the man page
Product: Red Hat Enterprise Linux 5 Reporter: Jason Willeford <jwilleford>
Component: mkinitrdAssignee: Brian Lane <bcl>
Status: CLOSED ERRATA QA Contact: Release Test Team <release-test-team-automation>
Severity: medium Docs Contact:
Priority: medium    
Version: 5.8CC: atodorov, ddumas, jstodola, leonfauster
Target Milestone: rc   
Target Release: 5.8   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: mkinitrd-5.1.19.6-72 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-02-21 05:34:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 726828    

Description Jason Willeford 2011-04-27 13:16:25 UTC
Description of problem:
There are a number of limitations documented in mkinitrd's man page, multipath needs to be added to that list.  mkinitrd will not build with FIPS enabled if /boot is on a multipath device.

Comment 1 RHEL Program Management 2011-08-05 12:31:49 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 2 Leon Fauster 2011-09-02 16:21:54 UTC
Problem:
mkinitrd will also not build with FIPS enabled if /boot is on a dmraid device

Comment 3 Leon Fauster 2011-09-02 16:47:21 UTC
to clarify: the initrd will be build but the boot process will fail because the boot partition can not
be mounted (to verify vmlinuz.hmac). 

to boot my system i changed the sequence of the init script (packaged in initrd) 
to initialize the dm device before the sha512hmac-checks are performed.

Comment 4 Brian Lane 2011-09-08 17:48:41 UTC
Paulo, that sounds like something we might be able to fix. Could you open a different bug with details on the problem and how you fixed it?

Comment 5 Leon Fauster 2011-09-09 14:35:25 UTC
https://bugzilla.redhat.com/show_bug.cgi?id=737081

Comment 7 Jan Stodola 2012-01-02 08:36:23 UTC
[root@chicken ~]# rpm -q mkinitrd
mkinitrd-5.1.19.6-75.el5

'man mkinitrd' says:

FIPS
...
       /boot  Must not be on multipath, nfs, dmraid or mdraid


Moving to VERIFIED.

Comment 8 errata-xmlrpc 2012-02-21 05:34:26 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0157.html