Commits on Aug 8, 2024

1. feat(fips-crypto-policies): Make c-p follow FIPS mode automatically …

   For a system that uses crypto-policies to be switched to FIPS mode
   correctly, it needs to be
   
   - booted with `fips=1` on the kernel command line
   - switched to the FIPS crypto-policy (or a policy derived from it)
   - have the fips dracut module enabled
   
   On older systems, there were additional steps, for example, creating
   `/etc/system-fips`.
   
   We have repeatedly seen inconsistencies between those different toggles,
   either because the user space tooling to switch between those does not
   (for reliability, maintainability, and compliance reasons) undo some of
   the steps it does when disabling FIPS mode, or because other
   installation methods (bootc, containers, image builder) independently do
   some of those steps. Eventually, all of these ended with user confusion.
   
   We can avoid this situation by eliminating the difference by treating
   the `fips=1` kernel command line switch as a single source of truth, and
   making all others follow automatically. This module provides this for
   crypto-policies, by adding bind-mounts before pivot if the system has
   not already been switched to a FIPS-based crypto-policy.
   
   This requires some support from the crypto-policies package (because it
   needs to deal with the bind mounts when a user calls
   `update-crypto-policies --set`), so make it a no-op unless
   
    - `fips=1` is on the kernel command line
    - crypto-policies is installed
    - crypto-policies supports the bind-mounts (indicated by the presence
      of the `default-fips-config` file)
    - the policy isn't already FIPS
   
   These checks should make this safe to add to the initramfs on all
   current systems.
   
   The bind-mounts also need to happen in the initramfs already, because
   systemd links against OpenSSL, and doing them later means that systemd
   will start with an OpenSSL configuration that isn't tailored for FIPS.
   
   See also [1], which adds the user space support to crypto-policies,
   along with a systemd service that does the same steps in case dracut
   hasn't already done them (which is useful for environments that don't
   use an initramfs like containers).
   
     [1]: https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/191
   
   Signed-off-by: Clemens Lang <[email protected]>

   

   neverpanic committed Aug 8, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for e9662a1
   • Browse repository at this point

   Copy the full SHA

   e9662a1 View commit details

   Browse the repository at this point in the history