From e096d861ed8d5956152aa0ba48ca17fb2de6efe0 Mon Sep 17 00:00:00 2001
From: Daniel Molkentin <dmolkentin@suse.com>
Date: Mon, 6 Jul 2020 16:36:42 +0200
Subject: [PATCH] 01fips: turn info calls into fips_info calls

systemd lets stdout go to journal only. Usually, this is desired
behavior to ensure that plymouth does not get disrupted.

However in the 01fips case, the system has to halt when the integrity
check fails to satisfy FIPS requirements. So the user will not be able
to inspect the journal.

As this is special to the fips module, we introduce a fips_info() which
works like info(), but deviates the output to stderr when running with
systemd.

Reference: bsc#1164076
---
 modules.d/01fips/fips.sh | 24 ++++++++++++++++++------
 1 file changed, 18 insertions(+), 6 deletions(-)

diff --git a/modules.d/01fips/fips.sh b/modules.d/01fips/fips.sh
index 37cde0c0..f46da5c6 100755
--- a/modules.d/01fips/fips.sh
+++ b/modules.d/01fips/fips.sh
@@ -1,5 +1,17 @@
 #!/bin/sh
 
+# systemd lets stdout go to journal only, but the system
+# has to halt when the integrity check fails to satisfy FIPS.
+if [ -z "$DRACUT_SYSTEMD" ]; then
+    fips_info() {
+        info "$*"
+    }
+else
+    fips_info() {
+        echo "$*" >&2
+    }
+fi
+
 mount_boot()
 {
     boot=$(getarg boot=)
@@ -45,7 +57,7 @@ mount_boot()
         [ -e "$boot" ] || return 1
 
         mkdir /boot
-        info "Mounting $boot as /boot"
+        fips_info "Mounting $boot as /boot"
         mount -oro "$boot" /boot || return 1
     elif [ -d "$NEWROOT/boot" ]; then
         rm -fr -- /boot
@@ -65,7 +77,7 @@ do_rhevh_check()
         warn "HMAC sum mismatch"
         return 1
     fi
-    info "rhevh_check OK"
+    fips_info "rhevh_check OK"
     return 0
 }
 
@@ -81,7 +93,7 @@ fips_load_crypto()
 {
     FIPSMODULES=$(cat /etc/fipsmodules)
 
-    info "Loading and integrity checking all crypto modules"
+    fips_info "Loading and integrity checking all crypto modules"
     mv /etc/modprobe.d/fips.conf /etc/modprobe.d/fips.conf.bak
     for _module in $FIPSMODULES; do
         if [ "$_module" != "tcrypt" ]; then
@@ -100,7 +112,7 @@ fips_load_crypto()
     done
     mv /etc/modprobe.d/fips.conf.bak /etc/modprobe.d/fips.conf
 
-    info "Self testing crypto algorithms"
+    fips_info "Self testing crypto algorithms"
     modprobe tcrypt || return 1
     rmmod tcrypt
 }
@@ -114,7 +126,7 @@ do_fips()
 
     KERNEL=$(uname -r)
 
-    info "Checking integrity of kernel"
+    fips_info "Checking integrity of kernel"
     if [ -e "/run/initramfs/live/vmlinuz0" ]; then
         do_rhevh_check /run/initramfs/live/vmlinuz0 || return 1
     elif [ -e "/run/initramfs/live/isolinux/vmlinuz0" ]; then
@@ -153,7 +165,7 @@ do_fips()
         (cd "${BOOT_IMAGE_HMAC%/*}" && sha512hmac -c "${BOOT_IMAGE_HMAC}") || return 1
     fi
 
-    info "All initrd crypto checks done"
+    fips_info "All initrd crypto checks done"
 
     > /tmp/fipsdone