Bug 1018459

Summary: Failed reboot the system with FIPS enabled.
Product: Red Hat Enterprise Linux 6 Reporter: xingge <gxing>
Component: certmongerAssignee: Nalin Dahyabhai <nalin>
Status: CLOSED WORKSFORME QA Contact: Kaleem <ksiddiqu>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.5CC: dpal, gxing, kchamart, ldai, liliu
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-19 10:10:12 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1061410    
Attachments:
Description Flags
the reboot screen shot. none

Description xingge 2013-10-12 08:45:42 UTC 
Description of problem:
Failed reboot the system with FIPS enabled, I use RHEL6.5-Snapshot-3 server64 system.

Version-Release number of selected component (if applicable):
certmonger-0.61-3.el6.x86_64
dracut-004-330.el6.noarch                     
dracut-fips-004-330.el6.noarch
dracut-kernel-004-330.el6.noarch



How reproducible:
always

Steps to Reproduce:
1. Enable FIPS mode
 1.1 Install dracut-fips and hamccalc 
 1.2 modify the /boot/grub/grub.conf to enable FIPS mode
2. reboot machine

Actual results:
Reboot failed.System boot stoped at the service certmonger. To check the details please see the attachment

Expected results:
system booted to FIPS mode

Additional info:
After I set prelink to NO and run "prelink -ua" reboot succeed but can't log in to the system "Authentication failed".
Comment 1 xingge 2013-10-12 08:47:36 UTC 
Created attachment 811525 [details]
the reboot screen shot.
Comment 2 RHEL Program Management 2013-10-13 23:00:06 UTC 
This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.
Comment 4 xingge 2013-10-18 09:52:34 UTC 
I installed the newest RHEL6.5 build RHEL6.5-Snapshot-4.0-server-x86_64, 
after I enable the fips mod and run cmd "prelink -ua", I reboot the system, and I login the system successfully. When I didn't run "prelink -ua" I meet this bug again, just like the attachment shows.
Comment 5 Nalin Dahyabhai 2013-10-18 14:04:04 UTC 
If you disable the certmonger service so that it doesn't attempt to start, how does that affect things?
Comment 6 xingge 2013-10-23 09:28:16 UTC 
In RHEL6.5-Snapshot-4, I disabled the certmonger service, and the boot stoped on starting rhsmcertd service; but if I run "prelink -ua" then I can reboot the system successfully, and I'm not disable the certmonger service.
Comment 7 Nalin Dahyabhai 2013-10-23 15:16:20 UTC 
This suggests that while certmonger needs fixes to work properly in FIPS mode, that alone won't be enough to solve the doesn't-finish-booting problem that you're seeing.  There are additional problems elsewhere which will also need to be solved.
Comment 8 Nalin Dahyabhai 2014-06-17 22:10:47 UTC 
Are you still seeing these errors on 6.5 with the latest certmonger build (as of this writing, certmonger-0.75.2-1.el6)?
Comment 9 xingge 2014-06-18 02:53:29 UTC 
hi Nalin
I use another method to enable FIPS in RHEL6.x and it works fine.
Comment 10 Nalin Dahyabhai 2014-06-18 15:26:17 UTC 
Can you elaborate on that?  I'm trying to figure out if there's something else here that needs fixing, or if I need to close this as works-for-me.
Comment 11 xingge 2014-06-19 10:10:12 UTC 
I use RHEL6.5GA server64 to check it bug and without use "prelink -ua" it still works fine, so I think you can close it. BTW I want to ask about how do I know the FIPS mode it running in my system, is there some method to check it?
Comment 12 Nalin Dahyabhai 2014-06-19 12:37:15 UTC 
Thanks!  FWIW, I tend to run 'sysctl crypto.fips_enabled' to check whether or not a system is in FIPS mode.  It consults /proc/sys/crypto/fips_enabled.