Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-104716

request backport 5beda2ea009046c1398ea5af868cc5743beb0f01 for RHEL 9.2.z

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Undefined Undefined
    • rhel-9.2.0.z
    • rhel-9.2.0.z
    • dracut
    • None
    • No
    • None
    • rhel-bootloader
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      Request backport of https://github.com/dracut-ng/dracut-ng/commit/5beda2ea009046c1398ea5af868cc5743beb0f01 to RHEL 9.4.z

       

      (RHEL 10 already has this patch, see https://github.com/redhat-plumbers/dracut-rhel10/commit/5beda2ea009046c1398ea5af868cc5743beb0f01)

      What were you trying to do that didn't work?

      rpm-ostree based operating systems (RHCOS, Edge) are not getting the fips shared objects installed in the initramfs because the 01fips module does not allow missing /dev/[u]random. rpm-ostree sets DRACUT_NO_MKNOD to 1 because it injects them in a different unprivilege-friendly way.

      What is the impact of this issue to you?

      fips is not properly enabled

      Please provide the package NVR for which the bug is seen:

      How reproducible is this bug?:

      100%

      Steps to reproduce

      1.  boot a RHCOS qcow2 that is based on RHEL 9.4 (Openshift 4.15, 4.14, 4.13) with console access
      2.  interrupt the boot process and hit e to edit the kernel command line
      3.  add fips=1 and rd.break=cmdline
      4. once dropped into the emergency shell, check for the existence of fips.so and openssl.cnf

      Expected results

      fips.so and openssl.cnf should be in the expected location

      Actual results

      fips.so and openssl.cnf is missing

              rhn-support-sbroz Stepan Broz
              mnguyen@redhat.com Michael Nguyen
              bootloader -eng-team bootloader -eng-team
              RHEL CS Plumbers QE Bot RHEL CS Plumbers QE Bot
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: