WIP Patch bootc FIPS dracut boot handling - #105
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rabi The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Build failed (check pipeline). Post ❌ eib-content-provider-build-images-cs9 FAILURE in 22m 20s |
rabi
changed the title
|
Build failed (check pipeline). Post ❌ eib-content-provider-build-images-cs9 FAILURE in 20m 32s |
bootc non-LUKS single-root deployments can fail FIPS boot because dracut's `01fips` module assumes `/boot` can be mounted read-only as a separate device. On bootc single-root layouts that mount can fail before the kernel HMAC check runs. Patch the image at build time so dracut falls back to bind-mounting the existing /boot tree when the default mount path fails. This is an image-side workaround for the current bootc single-root FIPS boot path; the underlying fix should eventually land upstream in dracut, bootc, or their interaction. Signed-off-by: rabi <ramishra@redhat.com>
|
Build failed (check pipeline). Post ❌ eib-content-provider-build-images-cs9 FAILURE in 18m 45s |
|
recheck |
1 participant
bootc non-LUKS single-root deployments can fail FIPS boot because dracut's
01fipsmodule assumes/bootcan be mounted read-only as a separate device. On bootc single-root layouts that mount can fail before the kernel HMAC check runs.Patch the image at build time so dracut falls back to bind-mounting the existing /boot tree when the default mount path fails. This is an image-side workaround for the current bootc single-root FIPS boot path; the underlying fix should eventually land upstream in dracut, bootc, or their interaction.