• crypto-policies-20241106-2.git7073416.el10
    • 1
    • rhel-sst-security-crypto
    • ssg_security
    • 11
    • 13
    • 1
    • False
    • Hide

      None

      Show
      None
    • Yes
    • Red Hat Enterprise Linux
    • Crypto24Q4
    • Hide

      AC1) fips-mode-setup and fips-finish-install, along with their manpages, are no longer shipped with RHEL

      AC2) No other manpages in the crypto-policies package reference or use fips-mode-setup or fips-finish-install

      AC3) Changes are announced on rhel-devel or rhel-planning lists

      AC4) Test tool depending on fips-mode-setup are updated not to rely on it

      AC5) Issue for docs team is created to update any RHEL-10 documentation mentioning fips-mode-setup.

      Show
      AC1) fips-mode-setup and fips-finish-install , along with their manpages, are no longer shipped with RHEL AC2) No other manpages in the crypto-policies package reference or use fips-mode-setup or fips-finish-install AC3) Changes are announced on rhel-devel or rhel-planning lists AC4) Test tool depending on fips-mode-setup are updated not to rely on it AC5) Issue for docs team is created to update any RHEL-10 documentation mentioning fips-mode-setup.
    • Pass
    • Enabled
    • Automated
    • Removed Functionality
    • Hide
      Description (describe the discontinued feature): The `fips-mode-setup` command that could be used to switch systems to FIPS mode after installation has been removed.
      Consequence (describe the recommended replacement, if applicable): Switching to FIPS mode is no longer supported after installation. To switch systems to FIPS mode,

      1. add `fips=1` to the kernel command line of the installer
      2. use Image Builder with
        ```
        [customizations]
        fips = true
        ```
        to build a FIPS-enabled image
      3. use Image Mode and add the `fips=1` kernel command line flag in your container file:
        ```
        FROM registry.redhat.io/rhel9/rhel-bootc:latest
        # Enable fips=1 kernel argument: https://containers.github.io/bootc/building/kernel-arguments.html
        COPY 01-fips.toml /usr/lib/bootc/kargs.d/
        # Enable the FIPS crypto policy
        # crypto-policies-scripts is not installed by default in RHEL-10
        RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS
        ```

      Disabling FIPS mode is not supported. To disable FIPS mode, re-install without enabling FIPS mode.

      Additional resources:
      - The sections modified in https://gitlab.cee.redhat.com/red-hat-enterprise-linux-documentation/rhel-10-docs/-/merge_requests/80
      - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/composing_installing_and_managing_rhel_for_edge_images/building-and-provisioning-simplified-installer-images_composing-installing-managing-rhel-for-edge-images#creating-and-booting-a-rhel-for-edge-image-in-fips-mode_building-and-provisioning-simplified-installer-images
      Show
      Description (describe the discontinued feature): The `fips-mode-setup` command that could be used to switch systems to FIPS mode after installation has been removed. Consequence (describe the recommended replacement, if applicable): Switching to FIPS mode is no longer supported after installation. To switch systems to FIPS mode, 1. add `fips=1` to the kernel command line of the installer 2. use Image Builder with   ```   [customizations]   fips = true   ```   to build a FIPS-enabled image 3. use Image Mode and add the `fips=1` kernel command line flag in your container file:   ```   FROM registry.redhat.io/rhel9/rhel-bootc:latest   # Enable fips=1 kernel argument: https://containers.github.io/bootc/building/kernel-arguments.html   COPY 01-fips.toml /usr/lib/bootc/kargs.d/   # Enable the FIPS crypto policy   # crypto-policies-scripts is not installed by default in RHEL-10   RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS   ``` Disabling FIPS mode is not supported. To disable FIPS mode, re-install without enabling FIPS mode. Additional resources: - The sections modified in https://gitlab.cee.redhat.com/red-hat-enterprise-linux-documentation/rhel-10-docs/-/merge_requests/80 - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/composing_installing_and_managing_rhel_for_edge_images/building-and-provisioning-simplified-installer-images_composing-installing-managing-rhel-for-edge-images#creating-and-booting-a-rhel-for-edge-image-in-fips-mode_building-and-provisioning-simplified-installer-images
    • Proposed
    • All
    • None

      Goal

      Remove fips-mode-setup. This is part of a bigger push to avoid the need for the tool in the first place, which was required because there are multiple knobs to turn when switching into FIPS mode; we are now moving towards a setup where these knobs are either eliminated completely, or follow the kernel command line flag fips=1 automatically, so that fips-mode-setup is no longer necessary.

      This also addresses potential issues when systems are initially set up outside of FIPS mode and then moved to FIPS mode afterwards, e.g., for algorithms used in LUKS disk encryption, or OpenSSH host keys.

      Acceptance criteria

      • fips-mode-setup and fips-finish-install, along with their manpages, are no longer shipped with RHEL. No other manpages in the crypto-policies package reference or use fips-mode-setup or fips-finish-install.

              omoris Ondrej Moris
              cllang@redhat.com Clemens Lang
              Clemens Lang Clemens Lang
              Ondrej Moris Ondrej Moris
              Mirek Jahoda Mirek Jahoda
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated: