Bug 831598

Description of problem:

FIPS integrity check provided by dracut fails in RHEL7. It causes that dracut dies during boot and kernel panics. When all 'die' in dracut-fips are replaced by 'warn' system boots into FIPS mode and you can see its init log file:

...
//sbin/fips.sh@53(do_fips): info 'Checking integrity of kernel'
//lib/dracut-lib.sh@316(info): check_quiet
//lib/dracut-lib.sh@301(check_quiet): '[' -z yes ']'
//lib/dracut-lib.sh@317(info): echo '<30>dracut: Checking integrity of kernel'
//lib/dracut-lib.sh@318(info): '[' yes '!=' yes ']'
//sbin/fips.sh@54(do_fips): newroot=/sysroot
///sbin/fips.sh@55(do_fips): uname -r
//sbin/fips.sh@55(do_fips): KERNEL=3.3.0-0.13.el7.x86_64
//sbin/fips.sh@57(do_fips): '[' -e /sysroot/boot/.vmlinuz-3.3.0-0.13.el7.x86_64.hmac ']'
//sbin/fips.sh@57(do_fips): unset newroot
//sbin/fips.sh@59(do_fips): ls -la /boot
total 24246
dr-xr-xr-x  5 root root     1024 Jun 12  2012 .
drwxr-xr-x 13 root root        0 Jun 12 13:37 ..
-rw-r--r--  1 root root      166 May 31 14:06 .vmlinuz-3.3.0-0.13.el7.x86_64.hmac
-rw-------  1 root root  2743548 May 31 14:06 System.map-3.3.0-0.13.el7.x86_64
-rw-r--r--  1 root root   113682 May 31 14:06 config-3.3.0-0.13.el7.x86_64
drwxr-xr-x  2 root root     1024 Jun  6 11:34 grub
drwxr-xr-x  6 root root     1024 Jun  6 11:41 grub2
-rw-r--r--  1 root root 16969413 Jun 12  2012 initramfs-3.3.0-0.13.el7.x86_64.img
drwx------  2 root root    12288 Jun  6 11:31 lost+found
-rwxr-xr-x  1 root root  4973104 May 31 14:06 vmlinuz-3.3.0-0.13.el7.x86_64
//sbin/fips.sh@60(do_fips): '[' -e /boot/.vmlinuz-3.3.0-0.13.el7.x86_64.hmac ']'
//sbin/fips.sh@65(do_fips): sha512hmac -c /boot/.vmlinuz-3.3.0-0.13.el7.x86_64.hmac
/boot/vmlinuz-3.3.0-0.13.el7.x86_64: OK
///sbin/fips.sh@67(do_fips): cat /etc/fipsmodules
//sbin/fips.sh@67(do_fips): FIPSMODULES='aead
aes_generic
aes-xts
aes-x86_64
ansi_cprng
cbc
ccm
chainiv
ctr
des
deflate
ecb
eseqiv
hmac
seqiv
sha256
sha512
cryptomgr
crypto_null
tcrypt
dm-mod
dm-crypt'
//sbin/fips.sh@69(do_fips): info 'Loading and integrity checking all crypto modules'
//lib/dracut-lib.sh@316(info): check_quiet
//lib/dracut-lib.sh@301(check_quiet): '[' -z yes ']'
//lib/dracut-lib.sh@317(info): echo '<30>dracut: Loading and integrity checking all crypto modules'
//lib/dracut-lib.sh@318(info): '[' yes '!=' yes ']'
//sbin/fips.sh@70(do_fips): for module in '$FIPSMODULES'
//sbin/fips.sh@71(do_fips): '[' aead '!=' tcrypt ']'
//sbin/fips.sh@72(do_fips): modprobe aead
//sbin/fips.sh@70(do_fips): for module in '$FIPSMODULES'
//sbin/fips.sh@71(do_fips): '[' aes_generic '!=' tcrypt ']'
//sbin/fips.sh@72(do_fips): modprobe aes_generic
//sbin/fips.sh@70(do_fips): for module in '$FIPSMODULES'
//sbin/fips.sh@71(do_fips): '[' aes-xts '!=' tcrypt ']'
//sbin/fips.sh@72(do_fips): modprobe aes-xts
FATAL: Module aes-xts not found.
//sbin/fips.sh@72(do_fips): return 1
///lib/dracut/hooks/pre-trigger/01fips-boot.sh@10(source): warn 'FIPS integrity test failed'
//lib/dracut-lib.sh@310(warn): check_quiet
//lib/dracut-lib.sh@301(check_quiet): '[' -z yes ']'
//lib/dracut-lib.sh@311(warn): echo '<28>dracut Warning: FIPS integrity test failed'
//lib/dracut-lib.sh@312(warn): echo 'dracut Warning: FIPS integrity test failed'
dracut Warning: FIPS integrity test failed
...

Obviously, the problems is caused by:

FATAL: Module aes-xts not found.

Version-Release number of selected component (if applicable):

dracut-fips-018-53.git20120605.el7.noarch
dracut-018-53.git20120605.el7.noarch
kernel-3.3.0-0.13.el7.x86_64

How reproducible:

100%

Steps to Reproduce:

1. uninstall of disable prelink
2. install dracut-fips
3. perl -pi -e 's#die #warn #g' /usr/lib/dracut/modules.d/01fips/*
4. dracut -f 
5. reboot and enter grub menu
6. add kernel parameters: rd.debug fips=1 boot=/dev/sda1 
   (or whatever your boot partition is) 
7. boot and see /run/initramfs/init.log
  
Actual results:

...
FATAL: Module aes-xts not found.
...
dracut Warning: FIPS integrity test failed
...

Expected results:

...
dracut: FIPS integrity test passed
...

Additional info:

See attachments.