Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adjust FIPS enable_fips_mode for RHEL 10 #12414

Merged
merged 3 commits into from
Sep 26, 2024
Merged

Adjust FIPS enable_fips_mode for RHEL 10 #12414

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
42449db
The /etc/system-fips file was depcreated in RHEL 9.
Mab879 Sep 20, 2024
7d9e0c8
Disable enable_dracut_fips_module check for FIPS
Mab879 Sep 24, 2024
4be6192
Use /proc/sys/crypto/fips_enabled everywhere in enable_fips_modes
Mab879 Sep 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,14 @@
<definition class="compliance" id="{{{ rule_id }}}" version="1">
{{{ oval_metadata("Check if FIPS mode is enabled on the system") }}}
<criteria operator="AND">
<extend_definition definition_ref="etc_system_fips_exists"
comment="check /etc/system-fips file existence"/>
<criterion test_ref="test_proc_sys_crypto_fips_enabled"
comment="check contents of /proc/sys/crypto/fips_enabled"/>
<extend_definition definition_ref="sysctl_crypto_fips_enabled"
comment="check option crypto.fips_enabled = 1 in sysctl"/>
{{%- if product not in ["rhel10"] -%}}
<extend_definition definition_ref="enable_dracut_fips_module"
comment="dracut FIPS module is enabled"/>
{{%- endif -%}}
<extend_definition definition_ref="configure_crypto_policy"
comment="system cryptography policy is configured"/>
<criterion test_ref="test_system_crypto_policy_value"
Expand Down Expand Up @@ -91,6 +93,18 @@ to a crypto policy module that further restricts the modified crypto policy.">
</ind:textfilecontent54_object>
{{% endif %}}

<ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="kernel runtime parameter crypto.fips_enabled set to 1"
id="test_proc_sys_crypto_fips_enabled" version="1">
<ind:object object_ref="obj_proc_sys_crypto_fips_enabled" />
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="obj_proc_sys_crypto_fips_enabled" version="1">
<ind:filepath>/proc/sys/crypto/fips_enabled</ind:filepath>
<ind:pattern operation="pattern match">^1$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>

<external_variable id="var_system_crypto_policy" version="1"
datatype="string" comment="variable which selects the crypto policy"/>
</def-group>
Loading