Bug 1148032

Summary:	prelink should be disabled or removed when installing in fips mode
Product:	Red Hat Enterprise Linux 6	Reporter:	Ondrej Moriš <omoris>
Component:	anaconda	Assignee:	Anaconda Maintenance Team <anaconda-maint-list>
Status:	CLOSED DUPLICATE	QA Contact:	Release Test Team <release-test-team-automation>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.6
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-09-30 14:47:31 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	691449

Description Ondrej Moriš 2014-09-30 14:43:37 UTC

Description of problem:

When a system is installed in fips mode. ie. when fips=1 kernel parameter is given to anaconda, anaconda automatically installs dracut-fips and supply fips=1 and boot=... parameters to kernel in bootloader so that the system is in fips mode after the reboot.

But no action with prelink is done and hence it is enabled after the installation and when cryptographic libraries gets prelinked system is corrupted. 

According to customer portal - in fips mode, prelink should be either disabled (prelink -ua && PRELINKING=no in /etc/sysconfig/prelink) or removed.

Version-Release number of selected component (if applicable):

Installer in RHEL-6.6-20140926.0 (RC 1.3)

How reproducible:

100%

Steps to Reproduce:

1. Set kernel parameter fips=1 before system installation.
2. Log in the installed system.
3. Verify that /proc/sys/crypto/fips_enabled contains 1.
4. Check that prelink is installed.

Actual results:

prelink-3.1.el6_4 installed and enabled 

Expected results:

prelink disabled or removed

Additional info:

N/A

Comment 1 Ondrej Moriš 2014-09-30 14:47:31 UTC


*** This bug has been marked as a duplicate of bug 697938 ***