Description of problem:When fips=1 in enabled on a server, and the server is booted into the generated rescue kernel entry, created by the dracut-config-rescue package. It will fail to boot since there isn't an hmac file for the rescue vmlinuz file.
Steps to Reproduce:
1. Install dracut-config-rescue, and install a kernel.
2. Enable fips=1 and try to boot into the generated rescue kernel.
[ 5.208328] dracut: FATAL: FIPS integrity test failed
[ 4.135472] dracut-pre-trigger: Warning: /boot//.vmlinuz-0-rescue-940ca953abe70648a79ff135488faa65.hmac does not exist
[ 5.213085] dracut: Refusing to continue
[ 5.259004] systemd-shutdown: Syncing filesystems and block devices.
[ 5.262052] systemd-shutdown: Sending SIGTERM to remaining processes...
[ 5.275614] systemd-journald: Received SIGTERM from PID 1 (systemd-shutdow).
[ 5.281783] systemd-shutdown: Sending SIGKILL to remaining processes...
[ 5.290363] systemd-shutdown: Unmounting file systems.
[ 5.293187] systemd-shutdown: Remounting '/boot' read-only in with options 'attr2,inode64,noquota'.
[ 5.297106] systemd-shutdown: Unmounting '/boot'.
[ 5.302889] XFS (vda1): Unmounting Filesystem
[ 5.308530] systemd-shutdown: Remounting '/var/lib/nfs/rpc_pipefs' read-only in with options ''.
[ 5.312126] systemd-shutdown: Unmounting '/var/lib/nfs/rpc_pipefs'.
[ 5.320073] systemd-shutdown: Remounting '/' read-only in with options ''.
[ 5.323103] systemd-shutdown: Remounting '/' read-only in with options ''.
[ 5.326387] systemd-shutdown: All filesystems unmounted.
[ 5.328598] systemd-shutdown: Deactivating swaps.
[ 5.330732] systemd-shutdown: All swaps deactivated.
[ 5.333400] systemd-shutdown: Detaching loop devices.
[ 5.335852] systemd-shutdown: All loop devices detached.
[ 5.338594] systemd-shutdown: Detaching DM devices.
[ 5.341373] systemd-shutdown: All DM devices detached.
[ 5.344509] systemd-shutdown: Syncing filesystems and block devices.
[ 5.347613] systemd-shutdown: Halting system.
[ 5.353328] System halted.
[ 4.402737] dracut-pre-trigger: /boot/vmlinuz-0-rescue-940ca953abe70648a79ff135488faa65: OK
[ 5.237294] XFS (vda1): Unmounting Filesystem
[ OK ] Started dracut pre-trigger hook.
- This also affects RHEL 8.
- I threw together the below patch that should create the hmac file on any new kernel install if the hmaccalc package is installed. Since the file is only needed for fips installs, only generate it for them. I set it up to use the sha512hmac to generate the hmac in case the original kernel that they rescue kernel was created from doesn't exist anymore. I'm not sure if this is the best way to fix the problem
# diff -up /etc/kernel/postinst.d/51-dracut-rescue-postinst.sh.old /etc/kernel/postinst.d/51-dracut-rescue-postinst.sh
--- /etc/kernel/postinst.d/51-dracut-rescue-postinst.sh.old 2018-09-27 09:47:05.000000000 -0400
+++ /etc/kernel/postinst.d/51-dracut-rescue-postinst.sh 2019-07-17 15:25:51.861383249 -0400
@@ -20,8 +20,15 @@ fi
-[[ -f $INITRDFILE ]] && [[ -f $NEW_KERNEL_IMAGE ]] && exit 0
+if [[ -f $INITRDFILE ]] && [[ -f $NEW_KERNEL_IMAGE ]]; then
+ if [[ -f $NEW_KERNEL_HMAC ]]; then
+ exit 0
+ elif [[ ! -f '/usr/bin/sha512hmac' ]]; then
+ exit 0
@@ -63,8 +70,14 @@ if [[ ! -f $NEW_KERNEL_IMAGE ]]; then
-new-kernel-pkg --install "$KERNEL_VERSION" --kernel-image "$NEW_KERNEL_IMAGE" --initrdfile "$INITRDFILE" --banner "$NAME $VERSION_ID Rescue $MACHINE_ID"
+if [[ ! -f $NEW_KERNEL_HMAC ]] && [[ -f '/usr/bin/sha512hmac' ]]; then
+ sha512hmac "$NEW_KERNEL_IMAGE" > "$NEW_KERNEL_HMAC"
+if [[ ! $(grep -r Rescue /boot/) ]]; then
+ new-kernel-pkg --install "$KERNEL_VERSION" --kernel-image "$NEW_KERNEL_IMAGE" --initrdfile "$INITRDFILE" --banner "$NAME $VERSION_ID Rescue $MACHINE_ID"
Can I ask you to post this as a PR to the dracut upstream?
(In reply to Lukáš Nykrýn from comment #2)
> Can I ask you to post this as a PR to the dracut upstream?
I apologize for the delay I totally forgot to check back on this bz, I just created a pull request let me know if anything else is needed. https://github.com/dracutdevs/dracut/pull/640
Red Hat Enterprise Linux 7 shipped it's final minor release on September 29th, 2020. 7.9 was the last minor releases scheduled for RHEL 7.
From intial triage it does not appear the remaining Bugzillas meet the inclusion criteria for Maintenance Phase 2 and will now be closed.
From the RHEL life cycle page:
"During Maintenance Support 2 Phase for Red Hat Enterprise Linux version 7,Red Hat defined Critical and Important impact Security Advisories (RHSAs) and selected (at Red Hat discretion) Urgent Priority Bug Fix Advisories (RHBAs) may be released as they become available."
If this BZ was closed in error and meets the above criteria please re-open it flag for 7.9.z, provide suitable business and technical justifications, and follow the process for Accelerated Fixes:
Feature Requests can re-opened and moved to RHEL 8 if the desired functionality is not already present in the product.
Please reach out to the applicable Product Experience Engineer if you have any questions or concerns.