Bug 1179239

Summary: Utilize system-wide crypto-policies
Product: [Fedora] Fedora Reporter: Nikos Mavrogiannopoulos <nmavrogi>
Component: rearAssignee: Gratien D'haese <gratien.dhaese>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 21CC: gratien.dhaese, i
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: rear-1.17.0-1.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-03-18 10:40:25 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1179209    

Description Nikos Mavrogiannopoulos 2015-01-06 13:14:23 UTC
Please convert to use the system's crypto policy for SSL and TLS:
https://fedoraproject.org/wiki/Packaging:CryptoPolicies

If this program is compiled against gnutls, change the default priority string to be "@SYSTEM" or to use gnutls_set_default_priority().

If this program is compiled against openssl, and there is no default cipher list specified, you don't need to modify it. Otherwise replace the default cipher list with "PROFILE=SYSTEM".

In both cases please verify that the application uses the system's crypto policies.

If the package is already using the system-wide crypto policies, or it does not use SSL or TLS, no action is required, the bug can simply be closed.

Comment 1 Fedora Update System 2015-03-13 15:17:47 UTC
rear-1.17.0-1.el5 has been submitted as an update for Fedora EPEL 5.
https://admin.fedoraproject.org/updates/rear-1.17.0-1.el5

Comment 2 Fedora Update System 2015-03-13 15:25:39 UTC
rear-1.17.0-1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/rear-1.17.0-1.el6

Comment 3 Fedora Update System 2015-03-13 15:41:06 UTC
rear-1.17.0-1.el7 has been submitted as an update for Fedora EPEL 7.
https://admin.fedoraproject.org/updates/rear-1.17.0-1.el7

Comment 4 Nikos Mavrogiannopoulos 2015-03-13 15:46:31 UTC
I have not checked the actual releases in EPEL, but note that this change for fedora crypto policies, currently, only works in Fedora 21+. Not in RHEL or any other EL.

Comment 5 Gratien D'haese 2015-03-13 16:29:59 UTC
I would not worry too much about it. I just added "COPY_AS_IS=( ${COPY_AS_IS[@]} /etc/crypto-policies )" to our frame-work build, which means if /etc/crypto-policies directory is present on the system (whatever distro we running it on) it will be copied to the ram disk of our rescue image.

see https://github.com/rear/rear/commit/7ec5eba19c270fee0401422b02462a44f3489722

It is completely harmless, but effective.

Comment 6 Fedora Update System 2015-03-13 16:30:43 UTC
rear-1.17.0-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/rear-1.17.0-1.fc20

Comment 7 Fedora Update System 2015-03-13 16:54:24 UTC
rear-1.17.0-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/rear-1.17.0-1.fc21

Comment 8 Fedora Update System 2015-03-13 17:06:24 UTC
rear-1.17.0-1.fc22 has been submitted as an update for Fedora 22.
https://admin.fedoraproject.org/updates/rear-1.17.0-1.fc22

Comment 9 Fedora Update System 2015-03-14 09:17:18 UTC
Package rear-1.17.0-1.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing rear-1.17.0-1.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-3860/rear-1.17.0-1.fc20
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2015-03-18 10:40:25 UTC
rear-1.17.0-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2015-03-26 21:27:03 UTC
rear-1.17.0-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2015-03-26 21:27:12 UTC
rear-1.17.0-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2015-04-01 01:56:00 UTC
rear-1.17.0-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 Fedora Update System 2015-04-01 01:56:04 UTC
rear-1.17.0-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 Fedora Update System 2015-04-01 01:56:30 UTC
rear-1.17.0-1.el7 has been pushed to the Fedora EPEL 7 stable repository.  If problems still persist, please make note of it in this bug report.