fi
}
+do_rhevh_check()
+{
+ KERNEL=$(uname -r)
+ kpath=${1}
+
+ # If we're on RHEV-H, the kernel is in /dev/.initramfs/live/vmlinuz0
+ HMAC_SUM_ORIG=$(cat /boot/.vmlinuz-${KERNEL}.hmac | while read a b; do printf "%s\n" $a; done)
+ HMAC_SUM_CALC=$(sha512hmac $kpath | while read a b; do printf "%s\n" $a; done || return 1)
+ if [ -z "$HMAC_SUM_ORIG" ] || [ -z "$HMAC_SUM_CALC" ] || [ "${HMAC_SUM_ORIG}" != "${HMAC_SUM_CALC}" ]; then
+ warn "HMAC sum mismatch"
+ return 1
+ fi
+ info "rhevh_check OK"
+ return 0
+}
+
do_fips()
{
local _v
rmmod tcrypt
info "Checking integrity of kernel"
- sha512hmac -c "/boot/.vmlinuz-${KERNEL}.hmac" || return 1
+ if [ -e "$NEWROOT/dev/.initramfs/live/vmlinuz0" ]; then
+ do_rhevh_check "$NEWROOT/dev/.initramfs/live/vmlinuz0" || return 1
+ elif [ -e "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" ]; then
+ do_rhevh_check "$NEWROOT/dev/.initramfs/live/isolinux/vmlinuz0" || return 1
+ else
+ sha512hmac -c "/boot/.vmlinuz-${KERNEL}.hmac" || return 1
+ fi
info "All initrd crypto checks done"