Re: PATCH [mkinitrd RHEL-5.4 FIPS 2/2] add kernel integrity checking to the generated initrd

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 04/21/2009 09:22 PM, Peter Jones wrote:
On 04/21/2009 01:43 PM, Hans de Goede wrote:

+if [ "$withfips" -eq 1 ]; then
+    if ! grep -q /boot $fstab; then

This check is bad, it catches /boot/efi and other such mountpoints erroneously.
Better to check if "bootfs" is set 3 lines later.

Will do.

+    inst /usr/bin/sha512hmac $MNTIMAGE/bin/sha512hmac
+    # sha512mac is dynamically linked and uses dlopen-ed .so files,
+    # this must be this way for libnss fips cert.
+    libs=$(ldd /usr/bin/sha512hmac | cut -d ' ' -f 3)

These libs will get pulled in by the "inst" line above.


No unfortunately they wont this is RHEl-5, where we do not use
dynamic linking in the initrd up to now. All inst does is ensure the dest
dir exists and then do a cp.

+    ld_linux=$(ldd /usr/bin/sha512hmac | cut -d ' ' -f 1 | grep ld-linux)

This will also get pulled in by the "inst" above.  Also, "ld-linux" isn't in
the name on all platforms.


Same as above, although it is very good to know that ld-linux may have a
different name on some archs, do you know the names or a better way to do this?

Regards,

Hans

_______________________________________________
Anaconda-devel-list mailing list
Anaconda-devel-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/anaconda-devel-list

[Index of Archives]     [Kickstart]     [Fedora Users]     [Fedora Legacy List]     [Fedora Maintainers]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]
  Powered by Linux