Description of problem: After rebuilding initramfs with dracut-fips installed and enabling fips (and adding boot partition UUID) in the grub.cfg, Fedora fails to boot with messages: XFS (sda2): Mounting V5 Filesystem XFS (sda2): Ending clean mount dracut: FATAL: FIPS integrity test failed dracut: Refusing to continue I can also see: dracut-pre-trigger[589]: libgcrypt selftest: binary (0): No such file or directory (/lib64/.libgcrypt.so.20.hmac) Root partition is encrypted, and boot bails out before asking for a passphrase, so it's expected that it can't find anything under /lib64 Editing grub entry and removing fips=1 allows me to boot. Entire procedure works just fine on CentOS 7, on the same hardware and setup. Version-Release number of selected component (if applicable): dracut-fips-aesni-043-63.git20151211.fc23.x86_64 How reproducible: Always Steps to Reproduce: 1. dnf update (reboot) 2. dnf install dracut-fips-aesni (or just dracut-fips) 3. dracut -f 4. add fips=1 and boot=UUID=xxx to /etc/defaut/grub Actual results: System halts Expected results: System boots Additional info:
(In reply to Ivan Bulatovic from comment #0) > Description of problem: > > After rebuilding initramfs with dracut-fips installed and enabling fips (and > adding boot partition UUID) in the grub.cfg, Fedora fails to boot with > messages: > > XFS (sda2): Mounting V5 Filesystem > XFS (sda2): Ending clean mount > dracut: FATAL: FIPS integrity test failed > dracut: Refusing to continue > > I can also see: > > dracut-pre-trigger[589]: libgcrypt selftest: binary (0): No such file or > directory (/lib64/.libgcrypt.so.20.hmac) > > Root partition is encrypted, and boot bails out before asking for a > passphrase, so it's expected that it can't find anything under /lib64 > > Editing grub entry and removing fips=1 allows me to boot. > > Entire procedure works just fine on CentOS 7, on the same hardware and setup. > > Version-Release number of selected component (if applicable): > > dracut-fips-aesni-043-63.git20151211.fc23.x86_64 > > How reproducible: Always > > Steps to Reproduce: > > 1. dnf update (reboot) > 2. dnf install dracut-fips-aesni (or just dracut-fips) > 3. dracut -f > 4. add fips=1 and boot=UUID=xxx to /etc/defaut/grub > > Actual results: > > System halts > > Expected results: > > System boots > > Additional info: please remove "quiet" and add "rd.debug" for more debugging output
Thanks for the help Harald. Problem is that dracut looks for checksum in .vmlinuz-4.4.5-300.fc23.x86_64.hmac instead of the available .vmlinuz.hmac-4.4.5-300.fc23.x86_64. When I rename the checksum as a workaround, dracut refuses to continue again, but this time because rot13 module is missing. Here is the relevant output (I can provide full log if needed): kernel image checksum issue: [ 5.223377] fedlock.localdomain kernel: XFS (sda2): Mounting V5 Filesystem [ 5.277723] fedlock.localdomain kernel: random: nonblocking pool is initialized [ 5.318769] fedlock.localdomain kernel: XFS (sda2): Ending clean mount [ 5.335517] fedlock.localdomain dracut: FATAL: FIPS integrity test failed [ 5.335528] fedlock.localdomain dracut: Refusing to continue [ 6.010202] fedlock.localdomain kernel: Console: switching to colour frame buffer device 170x48 [ 6.277552] fedlock.localdomain kernel: i915 0000:00:02.0: fb0: inteldrmfb frame buffer device [ 6.264637] fedlock.localdomain systemctl[653]: Libgcrypt error: integrity check using `/lib64/.libgcrypt.so.20.hmac' failed: No such file or directory [ 6.264723] fedlock.localdomain systemd[1]: Starting Dracut Emergency Shell... [ 6.264801] fedlock.localdomain systemctl[653]: Libgcrypt notice: state transition Self-Test => Error [ 6.264886] fedlock.localdomain dracut-pre-trigger[583]: Mounting /dev/disk/by-uuid/2be4f01f-bdad-4d31-aec6-db8c925e6d29 as /boot [ 6.264959] fedlock.localdomain dracut-pre-trigger[583]: Warning: /boot/.vmlinuz-4.4.5-300.fc23.x86_64.hmac does not exist [ 6.265044] fedlock.localdomain dracut-pre-trigger[583]: Warning: [ 6.265117] fedlock.localdomain dracut-pre-trigger[583]: Warning: dracut: FATAL: FIPS integrity test failed [ 6.265190] fedlock.localdomain dracut-pre-trigger[583]: Warning: dracut: Refusing to continue [ 6.265261] fedlock.localdomain dracut-pre-trigger[583]: Warning: /dev/disk/by-uuid/72788b76-58d4-43c5-a449-b0afc856b3de does not exist rot13 module missing: [ 6.257799] fedlock.localdomain systemctl[715]: Libgcrypt error: integrity check using `/lib64/.libgcrypt.so.20.hmac' failed: No such file or directory [ 6.257930] fedlock.localdomain systemd[1]: Starting Dracut Emergency Shell... [ 6.258065] fedlock.localdomain systemctl[715]: Libgcrypt notice: state transition Self-Test => Error [ 6.258203] fedlock.localdomain dracut-pre-trigger[583]: Mounting /dev/disk/by-uuid/2be4f01f-bdad-4d31-aec6-db8c925e6d29 as /boot [ 6.258323] fedlock.localdomain dracut-pre-trigger[583]: Loading and integrity checking all crypto modules [ 6.258448] fedlock.localdomain dracut-pre-trigger[583]: Warning: [ 6.258566] fedlock.localdomain dracut-pre-trigger[583]: Warning: dracut: FATAL: FIPS integrity test failed [ 6.258683] fedlock.localdomain dracut-pre-trigger[583]: Warning: dracut: Refusing to continue [ 6.258799] fedlock.localdomain dracut-pre-trigger[583]: Warning: /dev/disk/by-uuid/72788b76-58d4-43c5-a449-b0afc856b3de does not exist < < < [ 6.479102] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@90(do_fips): for _module in '$FIPSMODULES' [ 6.479556] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@91(do_fips): '[' rot13 '!=' tcrypt ']' [ 6.480013] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@92(do_fips): modprobe rot13 [ 6.480493] fedlock.localdomain dracut-pre-trigger[583]: modprobe: FATAL: Module rot13 not found in directory /lib/modules/4.4.5-300.fc23.x86_64 [ 6.480982] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@94(do_fips): _found=0 [ 6.481471] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@95(do_fips): read _k _s _v [ 6.481950] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@96(do_fips): '[' name '!=' name -a name '!=' driver ']' [ 6.482432] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@97(do_fips): '[' rmd320 '!=' rot13 ']' [ 6.482900] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@97(do_fips): continue [ 6.483374] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@95(do_fips): read _k _s _v [ 6.483852] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@96(do_fips): '[' driver '!=' name -a driver '!=' driver ']' [ 6.484337] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@97(do_fips): '[' rmd320-generic '!=' rot13 ']' [ 6.484810] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@97(do_fips): continue [ 6.485289] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@95(do_fips): read _k _s _v [ 6.485771] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@96(do_fips): '[' module '!=' name -a module '!=' driver ']' [ 6.486252] fedlock.localdomain dracut-pre-trigger[583]: //sbin/fips.sh@96(do_fips): continue
https://github.com/dracutdevs/dracut/commit/f7f5b82b4323210efc343132e3ae8fa91b26a68d
This message is a reminder that Fedora 23 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 23. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '23'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 23 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 23 changed to end-of-life (EOL) status on 2016-12-20. Fedora 23 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.