Bug 1010945
| Summary: | .hmac checksums for openssl are missing in initird | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Ondrej Moriš <omoris> |
| Component: | anaconda | Assignee: | Anaconda Maintenance Team <anaconda-maint-list> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Release Test Team <release-test-team-automation> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 6.5 | CC: | agk, dracut-maint-list, ebenes, lkardos, mvadkert, okozina, omoris, prajnoha, prockai, sbueno, sforsber, sgrubb, zkabelac |
| Target Milestone: | rc | ||
| Target Release: | 6.5 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2013-10-11 20:06:41 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 843829, 972747 | ||
|
Description
Ondrej Moriš
2013-09-23 10:53:23 UTC
(In reply to Ondrej Moriš from comment #0) > Description of problem: > > When an encryption checkbox in anaconda install of RHEL-6.5 Beta candidate > (RHEL6.5-20130913.0) is checked, anaconda use a default disk encryption > setup to encrypt /. You can successfully boot right after the installation > with chosen encryption password. However when you turn the system into fips > mode [1], the system does not boot at all, the password is not accepted and > dracut prints the following error: > > Password (/dev/vda2):dracut: FIPS checksum verification failed. > > [1] https://access.redhat.com/site/solutions/137833 > > Steps to Reproduce: I have also upgraded to the latest packages - ie. those from RHEL6.5-20130921.2: 0. yum upgrade -y > 1. Install the system via GUI using disk encryption (no specific setup). My guess would be that a hmac file is not in the initrd. I am wondering if you can tell if they are missing compared to an initrd made previously? (In reply to Steve Grubb from comment #2) > My guess would be that a hmac file is not in the initrd. I am wondering if > you can tell if they are missing compared to an initrd made previously? Yes, this seems to be the cause: Alpha ===== [initrd]# find . -name "*.hmac" | sort ./lib64/.libcryptsetup.so.1.1.0.hmac ./lib64/.libcryptsetup.so.1.hmac ./lib64/.libfipscheck.so.1.1.0.hmac ./lib64/.libfipscheck.so.1.hmac ./lib64/.libgcrypt.so.11.hmac ./sbin/.cryptsetup.hmac ./usr/bin/.fipscheck.hmac ./usr/lib64/hmaccalc/sha512hmac.hmac ./usr/lib64/.libcrypto.so.1.0.1e.hmac ./usr/lib64/.libcrypto.so.10.hmac ./usr/lib64/.libssl.so.1.0.1e.hmac Beta ==== [initrd]# find . -name "*.hmac" | sort ./lib64/.libcryptsetup.so.1.1.0.hmac ./lib64/.libcryptsetup.so.1.hmac ./lib64/.libfipscheck.so.1.1.1.hmac ./lib64/.libfipscheck.so.1.hmac ./lib64/.libgcrypt.so.11.hmac ./sbin/.cryptsetup.hmac ./usr/bin/.fipscheck.hmac ./usr/lib64/hmaccalc/sha512hmac.hmac Therefore the following hmacs are missing in Beta initrd (when rebuilt with dracut-fips): ./usr/lib64/.libcrypto.so.1.0.1e.hmac ./usr/lib64/.libcrypto.so.10.hmac ./usr/lib64/.libssl.so.1.0.1e.hmac (In reply to Ondrej Moriš from comment #3) > (In reply to Steve Grubb from comment #2) > > My guess would be that a hmac file is not in the initrd. I am wondering if > > you can tell if they are missing compared to an initrd made previously? > > Yes, this seems to be the cause: > > Alpha > ===== > > [initrd]# find . -name "*.hmac" | sort > ./lib64/.libcryptsetup.so.1.1.0.hmac > ./lib64/.libcryptsetup.so.1.hmac > ./lib64/.libfipscheck.so.1.1.0.hmac > ./lib64/.libfipscheck.so.1.hmac > ./lib64/.libgcrypt.so.11.hmac > ./sbin/.cryptsetup.hmac > ./usr/bin/.fipscheck.hmac > ./usr/lib64/hmaccalc/sha512hmac.hmac > ./usr/lib64/.libcrypto.so.1.0.1e.hmac > ./usr/lib64/.libcrypto.so.10.hmac > ./usr/lib64/.libssl.so.1.0.1e.hmac > > Beta > ==== > [initrd]# find . -name "*.hmac" | sort > ./lib64/.libcryptsetup.so.1.1.0.hmac > ./lib64/.libcryptsetup.so.1.hmac > ./lib64/.libfipscheck.so.1.1.1.hmac > ./lib64/.libfipscheck.so.1.hmac > ./lib64/.libgcrypt.so.11.hmac > ./sbin/.cryptsetup.hmac > ./usr/bin/.fipscheck.hmac > ./usr/lib64/hmaccalc/sha512hmac.hmac > > Therefore the following hmacs are missing in Beta initrd (when rebuilt with > dracut-fips): > > ./usr/lib64/.libcrypto.so.1.0.1e.hmac > ./usr/lib64/.libcrypto.so.10.hmac > ./usr/lib64/.libssl.so.1.0.1e.hmac Well, nothing changed in dracut. Is the package containing /usr/lib64/.libcrypto.so.1.0.1e.hmac installed, at the time, when the initramfs gets created (rpm posttrans)? Has this been retested with the current beta packages? This may be an artifact from the initial attempt to define the FIPS Product. If it is a leftover from moving the hmacs, then the bz can be closed. Thanks. Proposing as blocker since the report says this prevents the system from booting. *** Bug 1017755 has been marked as a duplicate of this bug. *** On the latest rhel65 compose (looks to be from 09 Oct), I see the hmac files which were originally missing in comment 3: [root@localhost initrd]# find . -name "*.hmac" | sort ./lib64/.libcryptsetup.so.1.1.0.hmac ./lib64/.libcryptsetup.so.1.hmac ./lib64/.libfipscheck.so.1.1.1.hmac ./lib64/.libfipscheck.so.1.hmac ./lib64/.libgcrypt.so.11.hmac ./sbin/.cryptsetup.hmac ./usr/bin/.fipscheck.hmac ./usr/lib64/hmaccalc/sha512hmac.hmac ./usr/lib64/.libcrypto.so.1.0.1e.hmac ./usr/lib64/.libcrypto.so.10.hmac ./usr/lib64/.libssl.so.1.0.1e.hmac So it seems to me this can be closed. |