-
Story
-
Resolution: Unresolved
-
Critical
-
None
-
crypto-policies-20241106-2.git7073416.el10
-
1
-
rhel-sst-security-crypto
-
ssg_security
-
11
-
13
-
1
-
False
-
-
Yes
-
Red Hat Enterprise Linux
-
Crypto24Q4
-
-
Pass
-
Enabled
-
Automated
-
Removed Functionality
-
-
Proposed
-
-
All
-
None
Goal
Remove fips-mode-setup. This is part of a bigger push to avoid the need for the tool in the first place, which was required because there are multiple knobs to turn when switching into FIPS mode; we are now moving towards a setup where these knobs are either eliminated completely, or follow the kernel command line flag fips=1 automatically, so that fips-mode-setup is no longer necessary.
This also addresses potential issues when systems are initially set up outside of FIPS mode and then moved to FIPS mode afterwards, e.g., for algorithms used in LUKS disk encryption, or OpenSSH host keys.
Acceptance criteria
- fips-mode-setup and fips-finish-install, along with their manpages, are no longer shipped with RHEL. No other manpages in the crypto-policies package reference or use fips-mode-setup or fips-finish-install.
- links to
-
RHBA-2024:139952 crypto-policies bug fix and enhancement update