From 37642d3614e9edc4fdcc89b3bf150bea69d47a78 Mon Sep 17 00:00:00 2001 From: Benjamin Gilbert Date: Thu, 22 Jul 2021 20:17:50 -0400 Subject: [PATCH] rhcos-fips: use "rdcore kargs" to update BLS entry rdcore only updates the latest BLS entry, but this is the first boot, so there should only be one. Also drop a spurious "sync" command. --- .../lib/dracut/modules.d/40rhcos-fips/rhcos-fips.sh | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/overlay.d/05rhcos/usr/lib/dracut/modules.d/40rhcos-fips/rhcos-fips.sh b/overlay.d/05rhcos/usr/lib/dracut/modules.d/40rhcos-fips/rhcos-fips.sh index 22e22cf36..63f853857 100755 --- a/overlay.d/05rhcos/usr/lib/dracut/modules.d/40rhcos-fips/rhcos-fips.sh +++ b/overlay.d/05rhcos/usr/lib/dracut/modules.d/40rhcos-fips/rhcos-fips.sh @@ -53,16 +53,10 @@ firstboot() { ;; esac - echo "FIPS mode required; updating BLS entries" + echo "FIPS mode required; updating BLS entry" - mkdir -p "${tmpsysroot}/boot" - mount /dev/disk/by-label/boot "${tmpsysroot}/boot" - - for f in "${tmpsysroot}"/boot/loader/entries/*.conf; do - echo "Appending 'fips=1 boot=LABEL=boot' to ${f}" - sed -e "/^options / s/$/ fips=1 boot=LABEL=boot/" -i "$f" - done - sync -f "${tmpsysroot}/boot" + rdcore kargs --boot-device /dev/disk/by-label/boot \ + --append fips=1 --append boot=LABEL=boot if [[ $(uname -m) = s390x ]]; then # Similar to https://github.com/coreos/coreos-assembler/commit/100c2e512ecb89786a53bfb1c81abc003776090d in the coreos-assembler