Bug 851504

Summary: Missing *.hmac files in FIPS initramfs
Product: [Fedora] Fedora Reporter: Milan Broz <mbroz>
Component: dracutAssignee: dracut-maint
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 17CC: dracut-maint, jonathan, pvrabec, pwouters
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 851185 Environment:
Last Closed: 2012-12-20 16:13:41 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 851185    
Bug Blocks: 717789    
Attachments:
Description Flags
Proposed patch for F17 none

Description Milan Broz 2012-08-24 11:39:02 UTC 
Created attachment 606836 [details]
Proposed patch for F17

+++ This bug was initially created as a clone of Bug #851185 +++

Description of problem:

Seems that dracut doesn not put FIPS *.hmac filer in initramfs, so fipscheck verification cannot succeed.

Version-Release number of selected component (if applicable):
dracut-018-98.git20120813.fc17


How reproducible:
Easy to test, just install crypt module dracut -f -a crypt and try to run cryptsetup in initramfs "cryptsetup status x" - it will fail with FIPS check failed.
Comment 1 Milan Broz 2012-08-24 11:40:56 UTC 
Please note that attached slightly differs from upstream in fips module, this line:
+    inst_libdir_file libssl.so.10

(if using only libssl.so it doesn't install proper symlinks in F17...)
Comment 2 Paul Wouters 2012-08-24 17:31:06 UTC 
Confirmed fips mode is working again with the latest kernel and these patches. Thanks!
Comment 3 Milan Broz 2012-09-05 13:31:28 UTC 
(this is not yet in build, setting to assigned for now)
Comment 4 Fedora Update System 2012-09-27 10:22:42 UTC 
dracut-018-60.git20120927.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/dracut-018-60.git20120927.fc16
Comment 5 Fedora Update System 2012-09-27 10:23:42 UTC 
dracut-018-105.git20120927.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/dracut-018-105.git20120927.fc17
Comment 6 Fedora Update System 2012-09-27 10:31:10 UTC 
dracut-018-105.git20120927.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/dracut-018-105.git20120927.fc17
Comment 7 Fedora Update System 2012-09-28 08:20:56 UTC 
Package dracut-018-105.git20120927.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing dracut-018-105.git20120927.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-14953/dracut-018-105.git20120927.fc17
then log in and leave karma (feedback).
Comment 8 Fedora Update System 2012-12-20 16:13:43 UTC 
dracut-018-105.git20120927.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.