A new rule `system_boot_in_fips_mode` #12671

Mab879 · 2024-12-04T20:00:23Z

Description:

Add new rule system_boot_in_fips_mode.

Rationale:

Since fips-mode-setup is gone is RHEL 10 we need to adjust our content for it.

github-actions · 2024-12-04T20:02:05Z

Start a new ephemeral environment with changes proposed in this pull request:

ol8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

jan-cerny · 2024-12-05T08:23:15Z

This new rule will check that the system currently runs in FIPS mode. But, How will we verify that the system is configured to start in FIPS mode?

Mab879 · 2024-12-05T13:30:48Z

This new rule will check that the system currently runs in FIPS mode. But, How will we verify that the system is configured to start in FIPS mode?

I have added the grub2 check as well.

ggbecker · 2024-12-09T14:57:14Z

linux_os/guide/system/software/integrity/fips/system_boot_in_fips_mode/rule.yml

+title: 'Verify that the system was booted with fips=1'
+
+description: |-
+    On a system where FIPS 14032 mode is enabled, the system must be booted with the


Suggested change

On a system where FIPS 14032 mode is enabled, the system must be booted with the

On a system where FIPS 140-2 mode is enabled, the system must be booted with the

Suggested change

On a system where FIPS 14032 mode is enabled, the system must be booted with the

On a system where FIPS 140-3 mode is enabled, the system must be booted with the

Which one is the correct one?

In crypto's docs, we prefer to use "FIPS 140" now, since there may be a FIPS 140-4 a lot sooner than the time it took to go from -2 to -3.

neverpanic · 2024-12-11T09:43:10Z

linux_os/guide/system/software/integrity/fips/is_fips_mode_enabled/rule.yml

@@ -1,7 +1,7 @@
 documentation_complete: true


-title: Verify '/proc/sys/crypto/fips_enabled' exists  
+title: Verify '/proc/sys/crypto/fips_enabled' exists


The mere existence of /proc/sys/crypto/fips_enabled is not sufficient. All kernels that support enabling FIPS mode will expose this file in user space. It must contain 1 for FIPS mode to be actually enabled.

I have removed this rule from RHEL 10.

neverpanic · 2024-12-11T09:46:47Z

linux_os/guide/system/software/integrity/fips/system_boot_in_fips_mode/oval/shared.xml

+
+    <ind:textfilecontent54_object id="obj_{{{ rule_id }}}_mode_exists" version="1">
+        <ind:filepath>/proc/cmdline</ind:filepath>
+        <ind:pattern operation="pattern match">.+fips*=1.+</ind:pattern>


Why does the pattern have a * between fips and the equals sign?

If this is a regex (which the starting .+ seems to indicate), then this would match fipsssss=1 or fip=1, which don't enable FIPS mode.

Also, this would match notreallyfips=1 due to the .+ before; That regex should probably instead be anchored by matching a word boundary, or explicitly search for whitespace before and after fips=1.

However, there's really no difference between the kernel command line containing fips=1 and /proc/sys/crypto/fips_enabled containing 1, so I'd propose checking for the latter instead, because it's much easier to do.

Thanks for the tip. That makes the check much easier.

neverpanic · 2024-12-11T09:47:35Z

linux_os/guide/system/software/integrity/fips/system_boot_in_fips_mode/rule.yml

+title: 'Verify that the system was booted with fips=1'
+
+description: |-
+    On a system where FIPS 14032 mode is enabled, the system must be booted with the


In crypto's docs, we prefer to use "FIPS 140" now, since there may be a FIPS 140-4 a lot sooner than the time it took to go from -2 to -3.

jan-cerny

The rule description isn't consistent with the OVAL check. The rule description says that users should check /proc/cmdline, but the OVAL check reads /proc/sys/crypto/fips_enabled. Although both ways of checking are effectively equivalent, you should keep the OVAL check aligned with the rule description or explain this difference in the rule description.

Mab879 · 2024-12-13T13:17:36Z

The rule description isn't consistent with the OVAL check. The rule description says that users should check /proc/cmdline, but the OVAL check reads /proc/sys/crypto/fips_enabled. Although both ways of checking are effectively equivalent, you should keep the OVAL check aligned with the rule description or explain this difference in the rule description.

I have adjust the rule description.

codeclimate · 2024-12-13T13:44:46Z

Code Climate has analyzed commit e4afdf5 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 60.9% (0.0% change).

View more on Code Climate.

Mab879 · 2024-12-13T17:09:01Z

/packit retest-failed

jan-cerny

I have built RHEL 10 content and verified that the rule is present in the built data stream.

Mab879 added this to the 0.1.76 milestone Dec 4, 2024

Mab879 marked this pull request as draft December 4, 2024 20:57

openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Dec 4, 2024

Mab879 force-pushed the fix_fips_rhel10 branch from b407b12 to 7dfd93c Compare December 4, 2024 21:55

Mab879 changed the title ~~Move to is_fips_mode_enabled for RHEL 10~~ A new rule system_boot_in_fips_mode Dec 4, 2024

Mab879 added the New Rule Issues or pull requests related to new Rules. label Dec 4, 2024

Mab879 force-pushed the fix_fips_rhel10 branch from 7dfd93c to a9802f7 Compare December 4, 2024 21:58

Mab879 added 2 commits December 5, 2024 06:59

Add new rule system_boot_in_fips_mode

33a664a

Add grub2_enable_fips_mode to RHEL 10

552c966

Mab879 force-pushed the fix_fips_rhel10 branch from a9802f7 to 552c966 Compare December 5, 2024 13:20

ggbecker reviewed Dec 9, 2024

View reviewed changes

Fix FIPS verison in system_boot_in_fips_mode description

ba9ef1b

Mab879 marked this pull request as ready for review December 10, 2024 13:24

openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Dec 10, 2024

Add RHEL 10 CCI to grub2_enable_fips_mode

8d2768a

neverpanic reviewed Dec 11, 2024

View reviewed changes

Mab879 added 2 commits December 11, 2024 12:26

Updated system_booted_in_fips_mode based on reviewer feedback

407bd4d

Remove is_fips_mode_enabled from RHEL 10

a5a3d90

Mab879 force-pushed the fix_fips_rhel10 branch from 7391a1d to a5a3d90 Compare December 11, 2024 18:47

neverpanic approved these changes Dec 12, 2024

View reviewed changes

jan-cerny self-assigned this Dec 13, 2024

jan-cerny requested changes Dec 13, 2024

View reviewed changes

Adjust system_booted_in_fips_mode prose based on new OVAL check

e4afdf5

jan-cerny approved these changes Dec 16, 2024

View reviewed changes

jan-cerny merged commit 301d803 into ComplianceAsCode:master Dec 16, 2024
99 of 105 checks passed

Mab879 deleted the fix_fips_rhel10 branch December 16, 2024 12:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

A new rule `system_boot_in_fips_mode` #12671

A new rule `system_boot_in_fips_mode` #12671

Mab879 commented Dec 4, 2024 •

edited

Loading

github-actions bot commented Dec 4, 2024 •

edited

Loading

jan-cerny commented Dec 5, 2024

Mab879 commented Dec 5, 2024

ggbecker Dec 9, 2024

Mab879 Dec 10, 2024

neverpanic Dec 11, 2024

neverpanic Dec 11, 2024

Mab879 Dec 11, 2024

neverpanic Dec 11, 2024

Mab879 Dec 11, 2024

neverpanic Dec 11, 2024

jan-cerny left a comment

Mab879 commented Dec 13, 2024

codeclimate bot commented Dec 13, 2024

Mab879 commented Dec 13, 2024

jan-cerny left a comment

	On a system where FIPS 14032 mode is enabled, the system must be booted with the
	On a system where FIPS 140-2 mode is enabled, the system must be booted with the

	On a system where FIPS 14032 mode is enabled, the system must be booted with the
	On a system where FIPS 140-3 mode is enabled, the system must be booted with the

A new rule system_boot_in_fips_mode #12671

A new rule system_boot_in_fips_mode #12671

Conversation

Mab879 commented Dec 4, 2024 • edited Loading

Description:

Rationale:

github-actions bot commented Dec 4, 2024 • edited Loading

jan-cerny commented Dec 5, 2024

Mab879 commented Dec 5, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jan-cerny left a comment

Choose a reason for hiding this comment

Mab879 commented Dec 13, 2024

codeclimate bot commented Dec 13, 2024

Mab879 commented Dec 13, 2024

jan-cerny left a comment

Choose a reason for hiding this comment

A new rule `system_boot_in_fips_mode` #12671

A new rule `system_boot_in_fips_mode` #12671

Mab879 commented Dec 4, 2024 •

edited

Loading

github-actions bot commented Dec 4, 2024 •

edited

Loading