Description of problem:
dracut-fips does not check BOOT_IMAGE carefully, and assumes .vmlinuz*.hmac will always be found in /boot, even when BOOT_IMAGE specifies a kernel in a subdirectory.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Put vmlinuz, initramfs, System.map, and .vmlinuz*.hmac in a subdirectory of /boot
2. Try to boot with fips=1
dracut-fips cannot find .vmlinuz*.hmac
BOOT_IMAGE supports booting from subdirectories, so dracut-fips should do the same.
the patch would probably break booting on s390x, since BOOT_IMAGE there doesn't contain the path to the kernel image - it identifies the number of the boot record that was selected in the bootloader, for example:
[root@rtt7 ~]# cat /proc/cmdline
root=/dev/mapper/rhel_rtt7-root crashkernel=auto rd.dasd=0.0.3227 rd.dasd=0.0.3427 rd.dasd=0.0.3727 rd.dasd=0.0.3027 rd.dasd=0.0.3527 rd.dasd=0.0.3327 rd.dasd=0.0.3127 rd.dasd=0.0.3627 rd.lvm.lv=rhel_rtt7/root rd.lvm.lv=rhel_rtt7/swap cio_ignore=all,!condev rd.znet=qeth,0.0.0a00,0.0.0a01,0.0.0a02,layer2=1,portno=0,portname=FOOBAR BOOT_IMAGE=2
(In reply to Jan Stodola from comment #3)
> Harald, Lukáš,
> the patch would probably break booting on s390x, since BOOT_IMAGE there
> doesn't contain the path to the kernel image - it identifies the number of
> the boot record that was selected in the bootloader, for example:
> [root@rtt7 ~]# cat /proc/cmdline
> root=/dev/mapper/rhel_rtt7-root crashkernel=auto rd.dasd=0.0.3227
> rd.dasd=0.0.3427 rd.dasd=0.0.3727 rd.dasd=0.0.3027 rd.dasd=0.0.3527
> rd.dasd=0.0.3327 rd.dasd=0.0.3127 rd.dasd=0.0.3627 rd.lvm.lv=rhel_rtt7/root
> rd.lvm.lv=rhel_rtt7/swap cio_ignore=all,!condev
> [root@rtt7 ~]#
Due to internal working of booting on s390x this fix does not work there because BOOT_IMAGE is not populated with the expected strings but a number instead.
On x86_64 the patch works as expected.
On s390x is the normal boot with everything in /boot unaffected but moving kernel, initrd and hmac into subdirectory results in broken boot as the hmac is still expected directly in /boot.
I am marking this as VERIFIED.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
Related to this, note that dracut was updated to handle relative paths in the HMAC file: https://github.com/dracutdevs/dracut/pull/661/commits/7e326aaf89f233818788df783e78a9854de2b54c. And rpm-ostree today hacks up the HMAC file for this: https://github.com/coreos/rpm-ostree/pull/1934.