Bug 1730896 - Generate an hmac file for generated rescue kernel entry.
Summary: Generate an hmac file for generated rescue kernel entry.
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: dracut
Version: 7.6
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Lukáš Nykrýn
QA Contact: qe-baseos-daemons
Depends On:
Blocks: 1801675
TreeView+ depends on / blocked
Reported: 2019-07-17 20:09 UTC by Ryan Blakley
Modified: 2020-11-11 21:57 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2020-11-11 21:57:33 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description Ryan Blakley 2019-07-17 20:09:38 UTC
Description of problem:When fips=1 in enabled on a server, and the server is booted into the generated rescue kernel entry, created by the dracut-config-rescue package. It will fail to boot since there isn't an hmac file for the rescue vmlinuz file.

Steps to Reproduce:
1. Install dracut-config-rescue, and install a kernel.
2. Enable fips=1 and try to boot into the generated rescue kernel.

Actual results:
[    5.208328] dracut: FATAL: FIPS integrity test failed
[    4.135472] dracut-pre-trigger[303]: Warning: /boot//.vmlinuz-0-rescue-940ca953abe70648a79ff135488faa65.hmac does not exist
[    5.213085] dracut: Refusing to continue
[    5.259004] systemd-shutdown[1]: Syncing filesystems and block devices.
[    5.262052] systemd-shutdown[1]: Sending SIGTERM to remaining processes...
[    5.275614] systemd-journald[104]: Received SIGTERM from PID 1 (systemd-shutdow).
[    5.281783] systemd-shutdown[1]: Sending SIGKILL to remaining processes...
[    5.290363] systemd-shutdown[1]: Unmounting file systems.
[    5.293187] systemd-shutdown[842]: Remounting '/boot' read-only in with options 'attr2,inode64,noquota'.
[    5.297106] systemd-shutdown[843]: Unmounting '/boot'.
[    5.302889] XFS (vda1): Unmounting Filesystem
[    5.308530] systemd-shutdown[844]: Remounting '/var/lib/nfs/rpc_pipefs' read-only in with options ''.
[    5.312126] systemd-shutdown[845]: Unmounting '/var/lib/nfs/rpc_pipefs'.
[    5.320073] systemd-shutdown[846]: Remounting '/' read-only in with options ''.
[    5.323103] systemd-shutdown[847]: Remounting '/' read-only in with options ''.
[    5.326387] systemd-shutdown[1]: All filesystems unmounted.
[    5.328598] systemd-shutdown[1]: Deactivating swaps.
[    5.330732] systemd-shutdown[1]: All swaps deactivated.
[    5.333400] systemd-shutdown[1]: Detaching loop devices.
[    5.335852] systemd-shutdown[1]: All loop devices detached.
[    5.338594] systemd-shutdown[1]: Detaching DM devices.
[    5.341373] systemd-shutdown[1]: All DM devices detached.
[    5.344509] systemd-shutdown[1]: Syncing filesystems and block devices.
[    5.347613] systemd-shutdown[1]: Halting system.
[    5.353328] System halted.

Expected results:
[    4.402737] dracut-pre-trigger[305]: /boot/vmlinuz-0-rescue-940ca953abe70648a79ff135488faa65: OK
[    5.237294] XFS (vda1): Unmounting Filesystem
[  OK  ] Started dracut pre-trigger hook.

Additional info:
- This also affects RHEL 8.
- I threw together the below patch that should create the hmac file on any new kernel install if the hmaccalc package is installed. Since the file is only needed for fips installs, only generate it for them. I set it up to use the sha512hmac to generate the hmac in case the original kernel that they rescue kernel was created from doesn't exist anymore. I'm not sure if this is the best way to fix the problem

# diff -up /etc/kernel/postinst.d/51-dracut-rescue-postinst.sh.old /etc/kernel/postinst.d/51-dracut-rescue-postinst.sh
--- /etc/kernel/postinst.d/51-dracut-rescue-postinst.sh.old	2018-09-27 09:47:05.000000000 -0400
+++ /etc/kernel/postinst.d/51-dracut-rescue-postinst.sh	2019-07-17 15:25:51.861383249 -0400
@@ -20,8 +20,15 @@ fi
-[[ -f $INITRDFILE ]] && [[ -f $NEW_KERNEL_IMAGE ]] && exit 0
+if [[ -f $INITRDFILE ]] && [[ -f $NEW_KERNEL_IMAGE ]]; then
+   if [[ -f $NEW_KERNEL_HMAC ]]; then
+      exit 0
+   elif [[ ! -f '/usr/bin/sha512hmac' ]]; then
+      exit 0
+   fi
@@ -63,8 +70,14 @@ if [[ ! -f $NEW_KERNEL_IMAGE ]]; then
-new-kernel-pkg --install "$KERNEL_VERSION" --kernel-image "$NEW_KERNEL_IMAGE" --initrdfile "$INITRDFILE" --banner "$NAME $VERSION_ID Rescue $MACHINE_ID"
+if [[ ! -f $NEW_KERNEL_HMAC ]] && [[ -f '/usr/bin/sha512hmac' ]]; then
+    sha512hmac "$NEW_KERNEL_IMAGE" > "$NEW_KERNEL_HMAC"
+    ((ret+=$?))
+if [[ ! $(grep -r Rescue /boot/) ]]; then
+   new-kernel-pkg --install "$KERNEL_VERSION" --kernel-image "$NEW_KERNEL_IMAGE" --initrdfile "$INITRDFILE" --banner "$NAME $VERSION_ID Rescue $MACHINE_ID"
+   ((ret+=$?))
 exit $ret

Comment 2 Lukáš Nykrýn 2019-07-23 12:01:15 UTC
Can I ask you to post this as a PR to the dracut upstream?

Comment 3 Ryan Blakley 2019-09-10 17:01:00 UTC
(In reply to Lukáš Nykrýn from comment #2)
> Can I ask you to post this as a PR to the dracut upstream?
> https://github.com/dracutdevs/dracut

I apologize for the delay I totally forgot to check back on this bz, I just created a pull request let me know if anything else is needed. https://github.com/dracutdevs/dracut/pull/640

Comment 6 Chris Williams 2020-11-11 21:57:33 UTC
Red Hat Enterprise Linux 7 shipped it's final minor release on September 29th, 2020. 7.9 was the last minor releases scheduled for RHEL 7.
From intial triage it does not appear the remaining Bugzillas meet the inclusion criteria for Maintenance Phase 2 and will now be closed. 

From the RHEL life cycle page:
"During Maintenance Support 2 Phase for Red Hat Enterprise Linux version 7,Red Hat defined Critical and Important impact Security Advisories (RHSAs) and selected (at Red Hat discretion) Urgent Priority Bug Fix Advisories (RHBAs) may be released as they become available."

If this BZ was closed in error and meets the above criteria please re-open it flag for 7.9.z, provide suitable business and technical justifications, and follow the process for Accelerated Fixes:

Feature Requests can re-opened and moved to RHEL 8 if the desired functionality is not already present in the product. 

Please reach out to the applicable Product Experience Engineer[0] if you have any questions or concerns.  

[0] https://bugzilla.redhat.com/page.cgi?id=agile_component_mapping.html&product=Red+Hat+Enterprise+Linux+7

Note You need to log in before you can comment on or make changes to this bug.