From: Vitaly Kuznetsov <[email protected]> redhat: hmac sign the UKI for FIPS
Dracut's FIPS module contains kernel integrity check for traditional kernels: /boot/vmlinuz-`uname-r`'s HMAC is compared to /boot/.vmlinuz-`uname-r`.hmac which is created duing kernel build. In preparation to enabling FIPS mode support for UKI, create HMAC for the it too. Signed-off-by: Vitaly Kuznetsov <[email protected]> diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template index blahblah..blahblah 100644 --- a/redhat/kernel.spec.template +++ b/redhat/kernel.spec.template @@ -2676,6 +2676,11 @@ BuildKernel() { # signkernel %endif + # hmac sign the UKI for FIPS + KernelUnifiedImageHMAC="$KernelUnifiedImageDir/.$InstallName-virt.efi.hmac" + %{log_msg "hmac sign the UKI for FIPS"} + %{log_msg "Creating hmac file: $KernelUnifiedImageHMAC"} + (cd $KernelUnifiedImageDir && sha512hmac $InstallName-virt.efi) > $KernelUnifiedImageHMAC; # with_efiuki %endif @@ -4009,6 +4014,7 @@ fi\ /lib/modules/%{KVERREL}%{?3:+%{3}}/config\ /lib/modules/%{KVERREL}%{?3:+%{3}}/modules.builtin*\ %attr(0644, root, root) /lib/modules/%{KVERREL}%{?3:+%{3}}/%{?-k:%{-k*}}%{!?-k:vmlinuz}-virt.efi\ +%attr(0644, root, root) /lib/modules/%{KVERREL}%{?3:+%{3}}/.%{?-k:%{-k*}}%{!?-k:vmlinuz}-virt.efi.hmac\ %ghost /%{image_install_path}/efi/EFI/Linux/%{?-k:%{-k*}}%{!?-k:*}-%{KVERREL}%{?3:+%{3}}.efi\ %{expand:%%files %{?3:%{3}-}uki-virt-addons}\ /lib/modules/%{KVERREL}%{?3:+%{3}}/%{?-k:%{-k*}}%{!?-k:vmlinuz}-virt.efi.extra.d/ \ -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3314 -- _______________________________________________ kernel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
