overlay.d/05core: Remove fips & modsign dracut modules

[travier]

• FIPS is not supported on Fedora
  See: https://fedoraproject.org/wiki/Changes/RemoveFipsModeSetup
  See: https://docs.fedoraproject.org/en-US/bootc/fips-crypto-policies/
• We don't include kernel module keys in the initrd

---

I'll do a before/after size comparison.

And add a link to coreos/fedora-coreos-tracker#302

[gemini-code-assist]

Code Review

This pull request updates the dracut configuration to omit the fips, fips-crypto-policies, and modsign modules from the initrd. A review comment identifies a potential regression for RHEL CoreOS (RHCOS) users, as those modules are still required for FIPS-compliant deployments on that distribution, and suggests making the omission conditional on the operating system.

[travier]

Size difference is minimal:

bash-5.3# ls -al /initramfs 
-rw-------. 1 root root 126767789 May  5 09:51 /initramfs
bash-5.3# ls -al /usr/lib/modules/6.19.12-200.fc43.x86_64/initramfs.img 
-rw-------. 1 root root 126829876 Jan  1  1970 /usr/lib/modules/6.19.12-200.fc43.x86_64/initramfs.img

$ podman run --rm -ti quay.io/fedora/fedora-coreos:stable bash
bash-5.3# ls -alh /usr/lib/modules/6.19.12-200.fc43.x86_64/initramfs.img 
-rw-------. 1 root root 121M Jan  1  1970 /usr/lib/modules/6.19.12-200.fc43.x86_64/initramfs.img

bash-5.3# vi /etc/dracut.conf.d/61-fcos-omits.conf

bash-5.3# kver=$(cd "/usr/lib/modules" && echo *)

bash-5.3# dracut -vf --install "/etc/passwd /etc/group" "/initramfs" "$kver"
dracut[E]: No '/dev/log' or 'logger' included for syslog logging
dracut[I]: Executing: /usr/bin/dracut -vf --install "/etc/passwd /etc/group" /initramfs 6.19.12-200.fc43.x86_64
dracut[I]: 62bluetooth: Could not find any command of '/usr/lib/bluetooth/bluetoothd /usr/libexec/bluetooth/bluetoothd'!
dracut-install: ERROR: installing '/root'
dracut[E]: FAILED: /usr/lib/dracut/dracut-install -D /var/tmp/dracut.dI0efyd/initramfs /root
dracut[I]: *** Including module: bash ***
dracut[I]: *** Including module: systemd ***
dracut[I]: *** Including module: scsi-rules ***
dracut[I]: *** Including module: systemd-ask-password ***
dracut[I]: *** Including module: systemd-battery-check ***
dracut[I]: *** Including module: systemd-cryptsetup ***
dracut[I]: *** Including module: systemd-initrd ***
dracut[I]: *** Including module: systemd-journald ***
dracut[I]: *** Including module: systemd-modules-load ***
dracut[I]: *** Including module: systemd-pcrphase ***
dracut[I]: *** Including module: systemd-sysctl ***
dracut[I]: *** Including module: systemd-sysusers ***
dracut[I]: *** Including module: systemd-tmpfiles ***
dracut[I]: *** Including module: systemd-udevd ***
dracut[I]: *** Including module: dbus-broker ***
dracut[I]: *** Including module: dbus ***
dracut[I]: *** Including module: coreos-sysctl ***
dracut[I]: *** Including module: i18n ***
dracut[I]: *** Including module: afterburn ***
dracut[I]: *** Including module: gcp-udev-rules ***
dracut[I]: *** Including module: ignition ***
dracut[I]: *** Including module: coreos-ignition ***
dracut[I]: *** Including module: coreos-live ***
dracut[I]: *** Including module: coreos-multipath ***
dracut[I]: *** Including module: coreos-network ***
dracut[I]: *** Including module: network-manager ***
dracut[I]: *** Including module: ignition-conf ***
dracut[I]: *** Including module: ignition-ostree ***
dracut[I]: *** Including module: network ***
dracut[I]: *** Including module: net-lib ***
dracut[I]: *** Including module: url-lib ***
dracut[I]: *** Including module: coreos-kernel ***
dracut[I]: *** Including module: ignition-conf-fcos ***
dracut[I]: *** Including module: ostree ***
dracut[I]: *** Including module: rdcore ***
dracut[I]: *** Including module: bootc ***
dracut[I]: *** Including module: clevis ***
dracut[I]: *** Including module: clevis-pin-null ***
dracut[I]: *** Including module: clevis-pin-sss ***
dracut[I]: *** Including module: clevis-pin-tang ***
dracut[I]: *** Including module: clevis-pin-tpm2 ***
dracut[I]: *** Including module: coreos-agetty-workaround ***
dracut[I]: *** Including module: btrfs ***
dracut[I]: *** Including module: crypt ***
dracut[I]: *** Including module: dm ***
dracut[I]: *** Including module: kernel-modules ***
dracut[I]: *** Including module: kernel-modules-extra ***
dracut[I]: *** Including module: kernel-network-modules ***
dracut[I]: *** Including module: mdraid ***
dracut[I]: *** Including module: multipath ***
dracut[I]: *** Including module: nvdimm ***
dracut[I]: *** Including module: qemu ***
dracut[I]: *** Including module: qemu-net ***
dracut[I]: *** Including module: fido2 ***
dracut[I]: *** Including module: pkcs11 ***
dracut[I]: *** Including module: tpm2-tss ***
dracut[I]: *** Including module: cifs ***
dracut[I]: *** Including module: hwdb ***
dracut[I]: *** Including module: iscsi ***
dracut[I]: *** Including module: lunmask ***
dracut[I]: *** Including module: nvmf ***
dracut[I]: *** Including module: resume ***
dracut[I]: *** Including module: rootfs-block ***
dracut[I]: *** Including module: terminfo ***
dracut[I]: *** Including module: udev-rules ***
dracut[I]: *** Including module: virtiofs ***
dracut[I]: *** Including module: azure-disk ***
dracut[I]: *** Including module: azure-unmanaged-sriov ***
dracut[I]: *** Including module: walinuxagent ***
dracut[I]: *** Including module: dracut-systemd ***
dracut[I]: *** Including module: usrmount ***
dracut[I]: *** Including module: base ***
dracut[I]: *** Including module: emergency-shell-setup ***
dracut[I]: *** Including module: fs-lib ***
dracut[I]: *** Including module: journal-conf ***
dracut[I]: *** Including module: shell-interpreter ***
dracut[I]: *** Including module: shutdown ***
dracut[I]: *** Including modules done ***
dracut[I]: *** Installing kernel module dependencies ***
dracut[I]: *** Installing kernel module dependencies done ***
dracut[I]: *** Resolving executable dependencies ***
dracut[I]: *** Resolving executable dependencies done ***
dracut[I]: *** Hardlinking files ***
dracut[I]: *** Hardlinking files done ***
dracut[I]: *** Generating early-microcode cpio image ***
dracut[I]: *** Constructing AuthenticAMD.bin ***
dracut[I]: *** Constructing GenuineIntel.bin ***
dracut[I]: *** Store current command line parameters ***
dracut[I]: *** Creating image file '/initramfs' ***
dracut[I]: *** Creating initramfs image file '/initramfs' done ***

bash-5.3# ls -alh /initramfs 
-rw-------. 1 root root 121M May  5 09:51 /initramfs