Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport fips-crypto-policies module #35

Closed
wants to merge 3 commits into from
Closed

Backport fips-crypto-policies module #35

wants to merge 3 commits into from

Commits on Sep 19, 2024

  1. feat(fips-crypto-policies): make c-p follow FIPS mode automatically 

    For a system that uses crypto-policies to be switched to FIPS mode
correctly, it needs to be

- booted with `fips=1` on the kernel command line
- switched to the FIPS crypto-policy (or a policy derived from it)
- have the fips dracut module enabled

On older systems, there were additional steps, for example, creating
`/etc/system-fips`.

We have repeatedly seen inconsistencies between those different toggles,
either because the user space tooling to switch between those does not
(for reliability, maintainability, and compliance reasons) undo some of
the steps it does when disabling FIPS mode, or because other
installation methods (bootc, containers, image builder) independently do
some of those steps. Eventually, all of these ended with user confusion.

We can avoid this situation by eliminating the difference by treating
the `fips=1` kernel command line switch as a single source of truth, and
making all others follow automatically. This module provides this for
crypto-policies, by adding bind-mounts before pivot if the system has
not already been switched to a FIPS-based crypto-policy.

This requires some support from the crypto-policies package (because it
needs to deal with the bind mounts when a user calls
`update-crypto-policies --set`), so make it a no-op unless

 - `fips=1` is on the kernel command line
 - crypto-policies is installed
 - crypto-policies supports the bind-mounts (indicated by the presence
   of the `default-fips-config` file)
 - the policy isn't already FIPS

These checks should make this safe to add to the initramfs on all
current systems.

The bind-mounts also need to happen in the initramfs already, because
systemd links against OpenSSL, and doing them later means that systemd
will start with an OpenSSL configuration that isn't tailored for FIPS.

See also [1], which adds the user space support to crypto-policies,
along with a systemd service that does the same steps in case dracut
hasn't already done them (which is useful for environments that don't
use an initramfs like containers).

  [1]: https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/191

Signed-off-by: Clemens Lang <[email protected]>
(cherry picked from commit bd3c1e1cc2f656f7ee4ff47e00ca716d52a86a3d)
    @neverpanic
    neverpanic committed Sep 19, 2024
    Configuration menu
    Copy the full SHA
    054ab85 View commit details
    Browse the repository at this point in the history

  2. fix(fips-crypto-policies): make it depend on fips dracut module 

    (cherry picked from commit a2096dafdbfc88eed91ce34b1f4d27e7eb7ca839)

Conflicts:
      modules.d/01fips-crypto-policies/module-setup.sh
      Due to upstream e6117b92fa0108dbaf9ea3ac0ec8f5a02487c812, which
      was not cherry-picked. Resolved the conflict by keeping the
      functions (i.e., undoing the cleanup of the upstream commit).
    @jozzsi @neverpanic
    jozzsi authored and neverpanic committed Sep 19, 2024
    Configuration menu
    Copy the full SHA
    88c76a1 View commit details
    Browse the repository at this point in the history

  3. build: package fips-crypto-policies module 

    Signed-off-by: Clemens Lang <[email protected]>
    @neverpanic
    neverpanic committed Sep 19, 2024
    Configuration menu
    Copy the full SHA
    9d91ff8 View commit details
    Browse the repository at this point in the history