RHEL FIPS Clean Up #12946

Mab879 · 2025-01-30T23:28:58Z

Description:

This makes it so the only way to enable FIPS mode on RHEL versions is fips=1 on install.

Rationale:

The fips-mode-setup command doesn't full get the system into FIPS 140 compliance.
For example it does not regenerate key material.

openshift-ci · 2025-01-30T23:29:02Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

jan-cerny · 2025-01-31T08:28:22Z

linux_os/guide/system/software/integrity/fips/enable_fips_mode/bash/shared.sh

@@ -6,21 +6,3 @@ if {{{ bash_bootc_build() }}}; then
 	cat > /usr/lib/bootc/kargs.d/01-fips.toml << EOF
 kargs = ["fips=1"]
 EOF
-else


Please remove also lines 2 and 5 in this file.

jan-cerny · 2025-01-31T09:11:04Z

linux_os/guide/system/software/integrity/fips/enable_dracut_fips_module/rule.yml

        The system needs to be rebooted for these changes to take effect.
+        {{% else %}}
+        To configure the operating system to run in FIPS 140 mode, the kernel parameter "fips=1" needs to be added during its installation.
+        Enabling FIPS mode on a preexisting system involves a number of modifications to it and therefore is not supported.


missing endif

jan-cerny · 2025-01-31T09:14:04Z

linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml


 warnings:
    - general: |-
-        The system needs to be rebooted for these changes to take effect.
+        To configure the operating system to run in FIPS 140 mode, the kernel parameter "fips=1" needs to be added during its installation.
+        Enabling FIPS mode on a preexisting system involves a number of modifications to it and therefore is not supported.


I would add:

Only enabling FIPS mode during the RHEL installation ensures that the system generates all keys with FIPS-approved algorithms and continuous monitoring tests in place.

jan-cerny · 2025-01-31T09:14:47Z

linux_os/guide/system/software/integrity/fips/sysctl_crypto_fips_enabled/rule.yml

@@ -56,7 +65,7 @@ warnings:
        See <b>{{{ weblink(link="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf") }}}</b>
        To meet this, the system has to have cryptographic software provided by a vendor that has
        undergone this certification. This means providing documentation, test results, design
-        information, and independent third party review by an accredited lab. While open source
+        information, and independent third parenable_dracut_fips_modulety review by an accredited lab. While open source


jan-cerny · 2025-01-31T09:24:17Z

linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml

@@ -22,6 +22,12 @@ description: |-
    <pre>kargs = ["fips=1"]</pre>
    Then set the cryptographic policy to <tt>{{{ xccdf_value("var_system_crypto_policy") }}}</tt>:
    <pre>update-crypto-policies --no-reload --set {{{ xccdf_value("var_system_crypto_policy") }}}</pre>
+{{% elif 'rhel' in product %}}


You need to change the conditions in the description.

The first block of the description (about fips-mode-setup) shouldn't go to RHEL 10 and maybe it should go to any RHEL.

"To enable FIPS mode at bootable container build time ..." should only go to products that support bootable containers, currently RHEL 9 and 10, or you can use the bootable_containers_supported variable.

The "Openshift ..." block should only go to rhcos4.

jan-cerny · 2025-01-31T09:33:49Z

linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml

+    <precat cat /proc/sys/crypto/fips_enabled</pre>
+    The output be must:
+    <pre>1</pre>


jan-cerny · 2025-01-31T09:39:45Z

linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode/rule.yml

@@ -7,6 +7,7 @@ description: |-
    To ensure FIPS mode is enabled, install package <tt>dracut-fips</tt>, and rebuild <tt>initramfs</tt> by running the following commands:
    <pre>{{{ package_install("dracut-fips") }}}
    dracut -f</pre>
+    {{% if 'rhel' not in product %}}


The description now looks weird for RHEL products. First, it says that to enable FIPS mode you should install dracut-fips and rebuild initramfs. Then, it says that this action will be worthless because it won't set FIPS up and you should have installed the system differently.

We need to reword this completely. Maybe start with describing the installation flag and then explain that the dracut thing serves to verify that the system is still in a good state.

github-actions · 2025-01-31T13:32:19Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_enable_dracut_fips_module'.
--- xccdf_org.ssgproject.content_rule_enable_dracut_fips_module
+++ xccdf_org.ssgproject.content_rule_enable_dracut_fips_module
@@ -3,13 +3,18 @@
 Enable Dracut FIPS Module
 
 [description]:
-To enable FIPS mode, run the following command:
-fips-mode-setup --enable
+Red Hat Enterprise Linux 8 has an installation-time kernel flag that can enable FIPS mode.
+The installer must be booted with fips=1 for the system to have FIPS mode
+enabled. Enabling FIPS mode on a preexisting system is not supported. If
+this rule fails on an installed system, then this is a permanent
+finding and cannot be fixed.
+
 To enable FIPS, the system requires that the fips module is added in dracut configuration.
 Check if /etc/dracut.conf.d/40-fips.conf contain add_dracutmodules+=" fips "
 
 [warning]:
-The system needs to be rebooted for these changes to take effect.
+To configure the operating system to run in FIPS 140 mode, the kernel parameter "fips=1" needs to be added during its installation.
+Enabling FIPS mode on a preexisting system involves a number of modifications to it and therefore is not supported.
 
 [warning]:
 System Crypto Modules must be provided by a vendor that undergoes FIPS-140 certifications.

New data stream is missing bash remediation for rule 'xccdf_org.ssgproject.content_rule_enable_dracut_fips_module'.
New data stream is missing ansible remediation for rule 'xccdf_org.ssgproject.content_rule_enable_dracut_fips_module'.
Platform has been changed for rule 'xccdf_org.ssgproject.content_rule_enable_dracut_fips_module'
--- xccdf_org.ssgproject.content_rule_enable_dracut_fips_module
+++ xccdf_org.ssgproject.content_rule_enable_dracut_fips_module
@@ -1 +1 @@
-
+oval:ssg-bootc:def:1

New content has different text for rule 'xccdf_org.ssgproject.content_rule_enable_fips_mode'.
--- xccdf_org.ssgproject.content_rule_enable_fips_mode
+++ xccdf_org.ssgproject.content_rule_enable_fips_mode
@@ -3,30 +3,22 @@
 Enable FIPS Mode
 
 [description]:
-To enable FIPS mode, run the following command:
-fips-mode-setup --enable
-         
-The fips-mode-setup command will configure the system in
-FIPS mode by automatically configuring the following:
-Setting the kernel FIPS mode flag (/proc/sys/crypto/fips_enabled) to 1
-          Creating /etc/system-fips
-          Setting the system crypto policy in /etc/crypto-policies/config to 'xccdf_org.ssgproject.content_value_var_system_crypto_policy'
-          Loading the Dracut fips module
-         
-To enable FIPS mode at bootable container build time configure fips=1 kernel argument
-in /usr/lib/bootc/kargs.d/01-fips.toml:
-kargs = ["fips=1"]
-Then set the cryptographic policy to 'xccdf_org.ssgproject.content_value_var_system_crypto_policy':
-update-crypto-policies --no-reload --set 'xccdf_org.ssgproject.content_value_var_system_crypto_policy'
+Red Hat Enterprise Linux 8 has an installation-time kernel flag that can enable FIPS mode.
+The installer must be booted with fips=1 for the system to have FIPS mode
+enabled. Enabling FIPS mode on a preexisting system is not supported. If
+this rule fails on an installed system, then this is a permanent
+finding and cannot be fixed.
 
 [warning]:
-The system needs to be rebooted for these changes to take effect.
+To configure Red Hat Enterprise Linux 8 to run in FIPS 140 mode, the kernel parameter "fips=1" needs to be added during its installation.
+Only enabling FIPS 140 mode during the Red Hat Enterprise Linux 8 installation ensures that the system generates all keys with FIPS-approved algorithms and continuous monitoring tests in place.
+Enabling FIPS mode on a preexisting system involves a number of modifications to it and therefore is not supported.
 
 [warning]:
 This rule DOES NOT CHECK if the components of the operating system are FIPS certified.
 You can find the list of FIPS certified modules at 
 https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules/search.
-This rule checks if the system is running in FIPS mode. See the rule description for more information about what it means.
+This rule checks if the system is running in FIPS mode.
 
 [reference]:
 CCI-002450

OCIL for rule 'xccdf_org.ssgproject.content_rule_enable_fips_mode' differs.
--- ocil:ssg-enable_fips_mode_ocil:questionnaire:1
+++ ocil:ssg-enable_fips_mode_ocil:questionnaire:1
@@ -1,10 +1,6 @@
 To verify that FIPS mode is enabled properly, run the following command:
-fips-mode-setup --check
-The output should contain the following:
-FIPS mode is enabled.
-To verify that the cryptographic policy has been configured correctly, run the
-following command:
-$ update-crypto-policies --show
-The output should return .
+cat /proc/sys/crypto/fips_enabled
+The output be must:
+1
       Is it the case that FIPS mode is not enabled?
       
bash remediation for rule 'xccdf_org.ssgproject.content_rule_enable_fips_mode' differs.
--- xccdf_org.ssgproject.content_rule_enable_fips_mode
+++ xccdf_org.ssgproject.content_rule_enable_fips_mode
@@ -1,31 +1,10 @@
 # Remediation is applicable only in certain platforms
 if ( ! ( [ "${container:-}" == "bwrap-osbuild" ] ) && rpm --quiet -q kernel ); then
 
-var_system_crypto_policy=''
-
-
 if [[ "$OSCAP_BOOTC_BUILD" == "YES" ]]; then
-	crypto_policies_no_reload="--no-reload"
 	cat > /usr/lib/bootc/kargs.d/01-fips.toml << EOF
 kargs = ["fips=1"]
 EOF
-else
-	fips-mode-setup --enable
-fi
-
-stderr_of_call=$(update-crypto-policies $crypto_policies_no_reload --set ${var_system_crypto_policy} 2>&1 > /dev/null)
-rc=$?
-
-if test "$rc" = 127; then
-	echo "$stderr_of_call" >&2
-	echo "Make sure that the script is installed on the remediated system." >&2
-	echo "See output of the 'dnf provides update-crypto-policies' command" >&2
-	echo "to see what package to (re)install" >&2
-
-	false  # end with an error code
-elif test "$rc" != 0; then
-	echo "Error invoking the update-crypto-policies script: $stderr_of_call" >&2
-	false  # end with an error code
 fi
 
 else

New data stream is missing ansible remediation for rule 'xccdf_org.ssgproject.content_rule_enable_fips_mode'.
New content has different text for rule 'xccdf_org.ssgproject.content_rule_etc_system_fips_exists'.
--- xccdf_org.ssgproject.content_rule_etc_system_fips_exists
+++ xccdf_org.ssgproject.content_rule_etc_system_fips_exists
@@ -4,11 +4,16 @@
 
 [description]:
 On a system where FIPS mode is enabled, /etc/system-fips must exist.
-To enable FIPS mode, run the following command:
-fips-mode-setup --enable
+
+Red Hat Enterprise Linux 8 has an installation-time kernel flag that can enable FIPS mode.
+The installer must be booted with fips=1 for the system to have FIPS mode
+enabled. Enabling FIPS mode on a preexisting system is not supported. If
+this rule fails on an installed system, then this is a permanent
+finding and cannot be fixed.
 
 [warning]:
-The system needs to be rebooted for these changes to take effect.
+To configure the operating system to run in FIPS 140 mode, the kernel parameter "fips=1" needs to be added during its installation.
+Enabling FIPS mode on a preexisting system involves a number of modifications to it and therefore is not supported.
 
 [warning]:
 System Crypto Modules must be provided by a vendor that undergoes

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled'.
--- xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled
+++ xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled
@@ -5,8 +5,14 @@
 [description]:
 System running in FIPS mode is indicated by kernel parameter
 'crypto.fips_enabled'. This parameter should be set to 1 in FIPS mode.
-To enable FIPS mode, run the following command:
-fips-mode-setup --enable
+
+Red Hat Enterprise Linux 8 has an installation-time kernel flag that can enable FIPS mode.
+The installer must be booted with fips=1 for the system to have FIPS mode
+enabled. Enabling FIPS mode on a preexisting system is not supported. If
+this rule fails on an installed system, then this is a permanent
+finding and cannot be fixed.
+
+
 
 To enable strict FIPS compliance, the fips=1 kernel option needs to be added to the kernel boot
 parameters during system installation so key generation is done with FIPS-approved algorithms

jan-cerny · 2025-02-03T07:43:59Z

RHSecurityCompliance/contest#322 has been merged, so let's try to rerun

jan-cerny · 2025-02-03T07:44:06Z

/packit build

linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode/rule.yml

jan-cerny · 2025-02-04T07:53:07Z

/packit build

matusmarhefka · 2025-02-04T13:31:19Z

With the changes from this PR the rule enable_fips_mode fails on RHEL9 with the test /hardening/container/bootc-image-builder, this is caused by the OVAL test enable_dracut_fips_module which I believe should be removed from the rule enable_fips_mode, at least on Image Mode. The OVAL test enable_dracut_fips_module is already used in the rule enable_dracut_fips_module for which we removed the remediation here as well.

I would propose to:

Remove the OVAL test enable_dracut_fips_module from the rule enable_fips_mode.
Add platform: not bootc into the rule enable_dracut_fips_module because per https://issues.redhat.com/browse/RHELBU-2798?focusedId=24884264&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-24884264, "RHEL image mode ships pregenerated initramfs by default, and the fips dracut module is included by default", so apparently our enable_dracut_fips_module OVAL test doesn't detect that correctly on Image Mode at the moment.

comps · 2025-02-04T13:33:42Z

This PR also causes

harden_sshd_ciphers_openssh_conf_crypto_policy
harden_sshd_macs_openssh_conf_crypto_policy

to be removed from the RHEL-8 datastream, so they should be added to the default profile (?).

comps · 2025-02-04T13:45:31Z

Also, this is likely what now breaks STIG profiles, a curious piece of remediation 😄

<xccdf-1.2:fix system="urn:xccdf:fix:script:sh" id="sshd_include_crypto_policy"># Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

dnf -y remove openssh-server
dnf -y install openssh-server
systemctl restart sshd.service

else
    &gt;&amp;2 echo 'Remediation is not applicable, nothing was done'
fi
</xccdf-1.2:fix>

For some reason, the install fails and there is no openssh-server on the system installed in the end.

Mab879 · 2025-02-04T13:57:18Z

This PR also causes
* `harden_sshd_ciphers_openssh_conf_crypto_policy`

* `harden_sshd_macs_openssh_conf_crypto_policy`
to be removed from the RHEL-8 datastream, so they should be added to the default profile (?).

This will be fixed by #12966

I will update the PR based for the Initramfs issue.

Remove remediations for RHEL and update rule

Update rules for RHEL to state must install via fips=1.

jan-cerny · 2025-02-04T16:35:47Z

@Mab879 And what about this?

Add platform: not bootc into the rule enable_dracut_fips_module because per https://issues.redhat.com/browse/RHELBU-2798?focusedId=24884264&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-24884264, "RHEL image mode ships pregenerated initramfs by default, and the fips dracut module is included by default", so apparently our enable_dracut_fips_module OVAL test doesn't detect that correctly on Image Mode at the moment.

codeclimate · 2025-02-04T17:30:41Z

Code Climate has analyzed commit 42fbc27 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

jan-cerny · 2025-02-05T07:47:59Z

/packit test centos-stream-8-x86_64:/static-checks

Mab879 added this to the 0.1.76 milestone Jan 30, 2025

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Jan 30, 2025

Mab879 mentioned this pull request Jan 30, 2025

Update rule enable_fips_mode for RHEL 10 #12916

Closed

jan-cerny reviewed Jan 31, 2025

View reviewed changes

comps mentioned this pull request Jan 31, 2025

unselect enable_fips_mode temporarily RHSecurityCompliance/contest#322

Merged

Mab879 added a commit to Mab879/content that referenced this pull request Jan 31, 2025

Address feedback in ComplianceAsCode#12946

e2b66d5

Mab879 marked this pull request as ready for review January 31, 2025 13:53

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Jan 31, 2025

jan-cerny self-assigned this Feb 3, 2025

jan-cerny reviewed Feb 3, 2025

View reviewed changes

linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode/rule.yml Outdated Show resolved Hide resolved

Mab879 added a commit to Mab879/content that referenced this pull request Feb 3, 2025

Apply feedback in ComplianceAsCode#12946

52b8ce4

Mab879 requested a review from jan-cerny February 3, 2025 13:30

Mab879 added a commit to Mab879/content that referenced this pull request Feb 3, 2025

Address feedback in ComplianceAsCode#12946

44a25cc

Mab879 added a commit to Mab879/content that referenced this pull request Feb 3, 2025

Apply feedback in ComplianceAsCode#12946

c10d93d

Mab879 force-pushed the clean_up_fips branch from 52b8ce4 to c10d93d Compare February 3, 2025 23:01

Mab879 added 6 commits February 4, 2025 09:26

Update enable_fips_mode

1a2d048

Update enable_dracut_fips_module

3331dd0

Remove remediations for RHEL and update rule

Update FIPS rules for RHEL

0674d9e

Update rules for RHEL to state must install via fips=1.

Address feedback in ComplianceAsCode#12946

2a9885b

Adjust warnings for FIPS mode.

0cbb36d

Apply feedback in ComplianceAsCode#12946

79cdcf5

Remove enable_dracut_fips_module for RHEL 9

e345d9e

Mab879 force-pushed the clean_up_fips branch from c10d93d to e345d9e Compare February 4, 2025 15:41

vojtapolasek modified the milestones: 0.1.76, 0.1.77 Feb 4, 2025

Exclude enable_dracut_fips_module from bootc

42fbc27

jan-cerny approved these changes Feb 5, 2025

View reviewed changes

jan-cerny merged commit 4a3a04f into ComplianceAsCode:master Feb 5, 2025
106 of 110 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

RHEL FIPS Clean Up #12946

RHEL FIPS Clean Up #12946

Mab879 commented Jan 30, 2025

openshift-ci bot commented Jan 30, 2025

jan-cerny Jan 31, 2025

jan-cerny Jan 31, 2025

jan-cerny Jan 31, 2025

jan-cerny Jan 31, 2025

jan-cerny Jan 31, 2025

jan-cerny Jan 31, 2025

jan-cerny Jan 31, 2025

github-actions bot commented Jan 31, 2025 •

edited

Loading

jan-cerny commented Feb 3, 2025

jan-cerny commented Feb 3, 2025

jan-cerny commented Feb 4, 2025

matusmarhefka commented Feb 4, 2025

comps commented Feb 4, 2025

comps commented Feb 4, 2025

Mab879 commented Feb 4, 2025

jan-cerny commented Feb 4, 2025

codeclimate bot commented Feb 4, 2025

jan-cerny commented Feb 5, 2025

RHEL FIPS Clean Up #12946

RHEL FIPS Clean Up #12946

Conversation

Mab879 commented Jan 30, 2025

Description:

Rationale:

openshift-ci bot commented Jan 30, 2025

jan-cerny Jan 31, 2025

Choose a reason for hiding this comment

jan-cerny Jan 31, 2025

Choose a reason for hiding this comment

jan-cerny Jan 31, 2025

Choose a reason for hiding this comment

jan-cerny Jan 31, 2025

Choose a reason for hiding this comment

jan-cerny Jan 31, 2025

Choose a reason for hiding this comment

jan-cerny Jan 31, 2025

Choose a reason for hiding this comment

jan-cerny Jan 31, 2025

Choose a reason for hiding this comment

github-actions bot commented Jan 31, 2025 • edited Loading

jan-cerny commented Feb 3, 2025

jan-cerny commented Feb 3, 2025

jan-cerny commented Feb 4, 2025

matusmarhefka commented Feb 4, 2025

comps commented Feb 4, 2025

comps commented Feb 4, 2025

Mab879 commented Feb 4, 2025

jan-cerny commented Feb 4, 2025

codeclimate bot commented Feb 4, 2025

jan-cerny commented Feb 5, 2025

github-actions bot commented Jan 31, 2025 •

edited

Loading