FIPS on Fedora and RHEL 8/9 images

[mmartinv]

• feat: enable FIPS customization in OS pipeline
• feat: enable FIPS customization in Anaconda tar installer
• feat: Enable FIPS customization for RHEL 9
• feat: Enable FIPS customization for RHEL 8
• feat: Enable FIPS customization for Fedora

[evgenyz]

Just to be clear here. Current ssg (0.1.69) won't try to enable FIPS during the oscap remediation phase since it caused troubles with bootloader. Idea is to keep it that way and use Blueprint instead as we do with partitions and packages.

What would be the Blueprint snippet to enable FIPS, BTW?

[kingsleyzissou]

The docs PR for the syntax is here:

osbuild/guides#154

Should just be:

fips = true

[kingsleyzissou]

FTR I'm testing this locally. Just ran into one or two issues, will report back

[mmartinv]

FTR I'm testing this locally. Just ran into one or two issues, will report back

It looks like the oscap remediation stage was setting the system's crypto policy to DEFAULT after it was set to FIPS by the update-crypto-policies stage so I moved the latter to be run just after the former.

[mmartinv]

I also posted osbuild/osbuild#1484 to fix RHEL/CentOS 8 builds.

[kingsleyzissou]

It looks like the oscap remediation stage was setting the system's crypto policy to DEFAULT after it was set to FIPS by the update-crypto-policies stage so I moved the latter to be run just after the former.

Yeah this was the issue I was running into, I haven't had time for getting back to it. Thanks for that

[evgenyz]

FTR I'm testing this locally. Just ran into one or two issues, will report back

It looks like the oscap remediation stage was setting the system's crypto policy to DEFAULT after it was set to FIPS by the update-crypto-policies stage so I moved the latter to be run just after the former.

That's not good. Ideally oscap should not switch policy from FIPS if it is set in the profile and use the FIPS mode it to adjust its behaviour.

Which profile does that?

[evgenyz]

OTOH, if the profile requires a different policy it should be OK that the FIPS mode is reset as the result of remediation.

TLDR: FIPS mode should be set before oscap stage. If there is a discrepancy in the behaviour it should be solved on the oscap/CaC side.

[evgenyz]

I'd even say that you should isolate enablement of Blueprint's fips=1 itself from the oscap stages. We'll deal with oscap later.

[mmartinv]

That's not good. Ideally oscap should not switch policy from FIPS if it is set in the profile and use the FIPS mode it to adjust its behaviour.

Which profile does that?

The blueprint configuration regarding oscap is:

      "openscap": {
        "profile_id": "xccdf_org.ssgproject.content_profile_pci-dss",
        "tailoring": {
          "selected": [
            "bind_crypto_policy"
          ],
          "unselected": [
            "rpm_verify_hashes",
            "enable_fips_mode"
          ]
        }
      }

I also tested by removing the enable_fips_mode from the unselected rules but the result is the same: the crypto policy is reset to the DEFAULT policy. I guess the problem is the bind_crypto_policy maybe?

[mmartinv]

Instead of using a copy of the all-with-oscap.json configuration I used all-customizations.json and added the "fips": true. Everything should work now.

[evgenyz]

That's not good. Ideally oscap should not switch policy from FIPS if it is set in the profile and use the FIPS mode it to adjust its behaviour.
Which profile does that?

>         "profile_id": "xccdf_org.ssgproject.content_profile_pci-dss",
>         "tailoring": {
>           "selected": [
>             "bind_crypto_policy"

The PCI-DSS profile does not require FIPS mode. It also ensures that DEFAULT crypto policy is in effect. No surprises here.

>           "unselected": [
>             "rpm_verify_hashes",
>             "enable_fips_mode"

I also tested by removing the enable_fips_mode from the unselected rules but the result is the same: the crypto policy is reset to the DEFAULT policy. I guess the problem is the bind_crypto_policy maybe?

The PCI-DSS profile actually does not have enable_fips_mode rule enabled. But even if it would have, the won't be executed with the current version of ssg content as it is disabled globally in osbuild env.

Anyhow, as I said, just get rid of oscap section. Test only BP customization itself. The oscap stage will be bootstrapped with initial BP customization and won't interfere unless misconfigured (but we'll deal with that ourselves).

[achilleas-k]

Looks good overall. Just one small question about the dracut stage and where it should be defined and reused.

[kingsleyzissou]

Looks good to me :)