Bug 1028435 - FIPS check fails one some RHEV-H isos
Summary: FIPS check fails one some RHEV-H isos
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: dracut
Version: 6.5
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: rc
: ---
Assignee: Harald Hoyer
QA Contact: Release Test Team
URL:
Whiteboard:
Depends On:
Blocks: 1029833 1029846
TreeView+ depends on / blocked
 
Reported: 2013-11-08 12:53 UTC by Fabian Deutsch
Modified: 2014-01-09 14:53 UTC (History)
12 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 1029833 (view as bug list)
Environment:
Last Closed: 2014-01-09 14:53:11 UTC


Attachments (Terms of Use)
Proposed patch (1.39 KB, patch)
2013-11-08 12:55 UTC, Harald Hoyer
no flags Details | Diff

Description Fabian Deutsch 2013-11-08 12:53:06 UTC
Description of problem:
The fips check fails on some RHEV-H isos because /sysroot/dev/.initramfs does not exist.
dracut should use /dev/.initramfs instead.

Version-Release number of selected component (if applicable):
dracut-004-335

How reproducible:
sometimes

Steps to Reproduce:
1. Boot one of the latest rhevh builds (brew) with fips=1
2.
3.

Actual results:
fips check fails

Expected results:
fips check passes

Additional info:

Comment 2 Harald Hoyer 2013-11-08 12:55:26 UTC
Created attachment 821603 [details]
Proposed patch

Comment 3 RHEL Product and Program Management 2013-11-11 13:07:15 UTC
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

Comment 4 Fabian Deutsch 2013-11-12 15:06:19 UTC
This was masked in earlier builds due to kernel bug 1016146. Now
that the kernel bug has been fixed this bug was uncovered.

The problem is that dracut is looking in the incorrect location for the kernel hmac.

Comment 5 Fabian Deutsch 2013-11-12 15:32:42 UTC
A suggested workaround is to symlink the kernel into the correct path at image creation time:

# ln -s /dev/.initramfs/live/isolinux/vmlinuz0 /boot/vmlinuz-<version>

This fix doesn't work, because the vmlinuz-* files are removed later in the livecd creation process.

Comment 7 Fabian Deutsch 2013-11-13 12:20:17 UTC
This bug can be triggered by adding fips=1 to the kernel cmdline

Comment 9 cshao 2013-11-15 08:12:42 UTC
Test version:
rhev-hypervisor6-6.5-20131114.2.3.2
ovirt-node-2.5.0-17.el6_4.14.noarch
dracut-004-336.el6_5.1.noarch

Test steps:
1. Auto install with fips=1
storage_init=/dev/sda adminpw=XXX fips=1 firstboot
2. check grub

Test result:
1. Auto install with fips=1 can successful no panic.
2. fips=1 stored in grub.conf.

So the bug is fixed with above version.

Comment 10 Eyal Edri 2013-11-24 10:17:52 UTC
can you provide info if it's fixed in 6.5-20131121.0.el6ev.noarch?

Comment 11 Guohua Ouyang 2013-12-04 09:02:39 UTC
(In reply to Eyal Edri from comment #10)
> can you provide info if it's fixed in 6.5-20131121.0.el6ev.noarch?

it's not fixed in 6.5-20131121.0.el6ev.noarch and 6.5-20131129.2.0.

dracut version in 6.5-20131129.2.0 is dracut-fips-004-335.el6.noarch.

Comment 12 Eyal Edri 2013-12-04 09:30:29 UTC
can you try please latest released RHEV-H - 6.5-20131127.0.el6ev.noarch.

fabian - i don't know how to verify this, or where is the list of FIXED bugs per a rhevh build (would be nice to automate this and get a report per build).

Comment 13 Guohua Ouyang 2013-12-04 10:03:27 UTC
tested 6.5-20131127.0.el6ev.noarch, not fixed too

Comment 14 Fabian Deutsch 2013-12-04 11:35:47 UTC
(In reply to Eyal Edri from comment #12)
> can you try please latest released RHEV-H - 6.5-20131127.0.el6ev.noarch.
> 
> fabian - i don't know how to verify this, or where is the list of FIXED bugs
> per a rhevh build (would be nice to automate this and get a report per
> build).

Hey Eyal,

normally all bugs fixed for a RHEV-H build can be found in the corresponding erratum. This wasn't really a bug in RHEV-H, therefor no RHEV-H bug existed which could be put in an errata.

This bug can be tested by appending fips=1 to the kernel arguments.
The fix for this problem landed in  dracut-004-336.el6_5.1, see bug 1029846 for the 6.5 bug (this bug is tracking the 6.6 bug/fix).


Note You need to log in before you can comment on or make changes to this bug.