Bug 1028435 - FIPS check fails one some RHEV-H isos
FIPS check fails one some RHEV-H isos
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: dracut (Show other bugs)
6.5
Unspecified Unspecified
urgent Severity urgent
: rc
: ---
Assigned To: Harald Hoyer
Release Test Team
: Regression, ZStream
Depends On:
Blocks: 1029833 1029846
  Show dependency treegraph
 
Reported: 2013-11-08 07:53 EST by Fabian Deutsch
Modified: 2014-01-09 09:53 EST (History)
12 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1029833 (view as bug list)
Environment:
Last Closed: 2014-01-09 09:53:11 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Proposed patch (1.39 KB, patch)
2013-11-08 07:55 EST, Harald Hoyer
no flags Details | Diff

  None (edit)
Description Fabian Deutsch 2013-11-08 07:53:06 EST
Description of problem:
The fips check fails on some RHEV-H isos because /sysroot/dev/.initramfs does not exist.
dracut should use /dev/.initramfs instead.

Version-Release number of selected component (if applicable):
dracut-004-335

How reproducible:
sometimes

Steps to Reproduce:
1. Boot one of the latest rhevh builds (brew) with fips=1
2.
3.

Actual results:
fips check fails

Expected results:
fips check passes

Additional info:
Comment 2 Harald Hoyer 2013-11-08 07:55:26 EST
Created attachment 821603 [details]
Proposed patch
Comment 3 RHEL Product and Program Management 2013-11-11 08:07:15 EST
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 4 Fabian Deutsch 2013-11-12 10:06:19 EST
This was masked in earlier builds due to kernel bug 1016146. Now
that the kernel bug has been fixed this bug was uncovered.

The problem is that dracut is looking in the incorrect location for the kernel hmac.
Comment 5 Fabian Deutsch 2013-11-12 10:32:42 EST
A suggested workaround is to symlink the kernel into the correct path at image creation time:

# ln -s /dev/.initramfs/live/isolinux/vmlinuz0 /boot/vmlinuz-<version>

This fix doesn't work, because the vmlinuz-* files are removed later in the livecd creation process.
Comment 7 Fabian Deutsch 2013-11-13 07:20:17 EST
This bug can be triggered by adding fips=1 to the kernel cmdline
Comment 9 cshao 2013-11-15 03:12:42 EST
Test version:
rhev-hypervisor6-6.5-20131114.2.3.2
ovirt-node-2.5.0-17.el6_4.14.noarch
dracut-004-336.el6_5.1.noarch

Test steps:
1. Auto install with fips=1
storage_init=/dev/sda adminpw=XXX fips=1 firstboot
2. check grub

Test result:
1. Auto install with fips=1 can successful no panic.
2. fips=1 stored in grub.conf.

So the bug is fixed with above version.
Comment 10 Eyal Edri 2013-11-24 05:17:52 EST
can you provide info if it's fixed in 6.5-20131121.0.el6ev.noarch?
Comment 11 Guohua Ouyang 2013-12-04 04:02:39 EST
(In reply to Eyal Edri from comment #10)
> can you provide info if it's fixed in 6.5-20131121.0.el6ev.noarch?

it's not fixed in 6.5-20131121.0.el6ev.noarch and 6.5-20131129.2.0.

dracut version in 6.5-20131129.2.0 is dracut-fips-004-335.el6.noarch.
Comment 12 Eyal Edri 2013-12-04 04:30:29 EST
can you try please latest released RHEV-H - 6.5-20131127.0.el6ev.noarch.

fabian - i don't know how to verify this, or where is the list of FIXED bugs per a rhevh build (would be nice to automate this and get a report per build).
Comment 13 Guohua Ouyang 2013-12-04 05:03:27 EST
tested 6.5-20131127.0.el6ev.noarch, not fixed too
Comment 14 Fabian Deutsch 2013-12-04 06:35:47 EST
(In reply to Eyal Edri from comment #12)
> can you try please latest released RHEV-H - 6.5-20131127.0.el6ev.noarch.
> 
> fabian - i don't know how to verify this, or where is the list of FIXED bugs
> per a rhevh build (would be nice to automate this and get a report per
> build).

Hey Eyal,

normally all bugs fixed for a RHEV-H build can be found in the corresponding erratum. This wasn't really a bug in RHEV-H, therefor no RHEV-H bug existed which could be put in an errata.

This bug can be tested by appending fips=1 to the kernel arguments.
The fix for this problem landed in  dracut-004-336.el6_5.1, see bug 1029846 for the 6.5 bug (this bug is tracking the 6.6 bug/fix).

Note You need to log in before you can comment on or make changes to this bug.