Bug 700102 - Add multipath to the list of limitations of mkinitrd's FIPS support in the man page
Summary: Add multipath to the list of limitations of mkinitrd's FIPS support in the ma...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: mkinitrd
Version: 5.8
Hardware: All
OS: Linux
medium
medium
Target Milestone: rc
: 5.8
Assignee: Brian Lane
QA Contact: Release Test Team
URL:
Whiteboard:
Depends On:
Blocks: 726828
TreeView+ depends on / blocked
 
Reported: 2011-04-27 13:16 UTC by Jason Willeford
Modified: 2018-11-14 16:55 UTC (History)
4 users (show)

Fixed In Version: mkinitrd-5.1.19.6-72
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-02-21 05:34:26 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2012:0157 normal SHIPPED_LIVE mkinitrd bug fix update 2012-02-20 14:54:17 UTC

Description Jason Willeford 2011-04-27 13:16:25 UTC
Description of problem:
There are a number of limitations documented in mkinitrd's man page, multipath needs to be added to that list.  mkinitrd will not build with FIPS enabled if /boot is on a multipath device.

Comment 1 RHEL Program Management 2011-08-05 12:31:49 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 2 Leon Fauster 2011-09-02 16:21:54 UTC
Problem:
mkinitrd will also not build with FIPS enabled if /boot is on a dmraid device

Comment 3 Leon Fauster 2011-09-02 16:47:21 UTC
to clarify: the initrd will be build but the boot process will fail because the boot partition can not
be mounted (to verify vmlinuz.hmac). 

to boot my system i changed the sequence of the init script (packaged in initrd) 
to initialize the dm device before the sha512hmac-checks are performed.

Comment 4 Brian Lane 2011-09-08 17:48:41 UTC
Paulo, that sounds like something we might be able to fix. Could you open a different bug with details on the problem and how you fixed it?

Comment 5 Leon Fauster 2011-09-09 14:35:25 UTC
https://bugzilla.redhat.com/show_bug.cgi?id=737081

Comment 7 Jan Stodola 2012-01-02 08:36:23 UTC
[root@chicken ~]# rpm -q mkinitrd
mkinitrd-5.1.19.6-75.el5

'man mkinitrd' says:

FIPS
...
       /boot  Must not be on multipath, nfs, dmraid or mdraid


Moving to VERIFIED.

Comment 8 errata-xmlrpc 2012-02-21 05:34:26 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2012-0157.html


Note You need to log in before you can comment on or make changes to this bug.