Re: PATCH [mkinitrd RHEL-5.4 FIPS 2/2] add kernel integrity checking to the generated initrd

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 04/22/2009 08:48 PM, Peter Jones wrote:
On 04/22/2009 03:03 AM, Hans de Goede wrote:

On 04/21/2009 09:22 PM, Peter Jones wrote:
On 04/21/2009 01:43 PM, Hans de Goede wrote:

+if [ "$withfips" -eq 1 ]; then
+    if ! grep -q /boot $fstab; then
This check is bad, it catches /boot/efi and other such mountpoints
erroneously.
Better to check if "bootfs" is set 3 lines later.
Will do.

+    inst /usr/bin/sha512hmac $MNTIMAGE/bin/sha512hmac
+    # sha512mac is dynamically linked and uses dlopen-ed .so files,
+    # this must be this way for libnss fips cert.
+    libs=$(ldd /usr/bin/sha512hmac | cut -d ' ' -f 3)
These libs will get pulled in by the "inst" line above.

No unfortunately they wont this is RHEl-5, where we do not use
dynamic linking in the initrd up to now. All inst does is ensure the dest
dir exists and then do a cp.

Oh, indeed.

+    ld_linux=$(ldd /usr/bin/sha512hmac | cut -d ' ' -f 1 | grep
ld-linux)
This will also get pulled in by the "inst" above.  Also, "ld-linux"
isn't in
the name on all platforms.

Same as above, although it is very good to know that ld-linux may have a
different name on some archs, do you know the names or a better way to
do this?

See showElfInterpCommand() in master, and the code that calls it in get_dso_deps() in "functions".


You've got to be kidding me :(

Well, the elf interpreter is the only one with a full path in the first column of the ldd output,
so how about:
ld_linux=$(ldd /usr/bin/sha512hmac | cut -d ' ' -f 1 | grep /lib)


?

That works for me on both i386 and x86_64 (as did the previous version)

Regards,

Hans

_______________________________________________
Anaconda-devel-list mailing list
Anaconda-devel-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/anaconda-devel-list

[Index of Archives]     [Kickstart]     [Fedora Users]     [Fedora Legacy List]     [Fedora Maintainers]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [Yosemite Photos]     [KDE Users]     [Fedora Tools]
  Powered by Linux