Bug 1672023

Summary:	[RHEL 8 HTB] update-crypto-policies/fips-mode-setup hangs server
Product:	Red Hat Enterprise Linux 8	Reporter:	Yogita <ysoni>
Component:	crypto-policies	Assignee:	Tomas Mraz <tmraz>
Status:	CLOSED CURRENTRELEASE	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.1	CC:	deepak.rajaling, jreznik, nmavrogi, szidek, tmraz, ysoni
Target Milestone:	rc
Target Release:	8.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-04-03 13:17:59 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Yogita 2019-02-03 08:17:52 UTC

Description of problem:

When moving a normal minimal install of Red Hat Enterprise Linux 8 to FIPS mode compliant using:
# update-crypto-policies --set FIPS
# fips-mode-setup --enable
and then rebooting the server according to instructions from update-crypto-policies/fips-mode-setup the server hangs and a power cycle is required to get the server to boot up again.

Can only replicate issue on fresh install of RHEL8 Snap2 though. CANNOT replicate by switching back and forth between FIPS and DEFAULT, like such:
# fips-mode-setup --disable
# update-crypto-policies --set DEFAULT
# reboot
# fips-mode-setup --enable
# update-crypto-policies --set FIPS
# reboot

Expected results:
Server should boot without hang

Additional info:

Comment 1 Tomas Mraz 2019-02-04 09:58:07 UTC

There is no need to explicitly call update-crypto-policies --set FIPS or update-crypto-policies --set DEFAULT.

The command prints warning to not do that even.

The fips-mode-setup --enable and  fips-mode-setup --disable implicitly changes the crypto policy to FIPS and back to DEFAULT.

As for the hang - I think this is just continuous manifestation of the "too low entropy in kernel" during boot. We made multiple workarounds how to improve the situation however apparently the problem still happens sometimes.

To further debug it is crucial to find out at which stage during the boot the boot hangs.

Comment 2 Tomas Mraz 2019-02-04 10:04:09 UTC

Also we need to know the exact details of the machine - is it virtual or real hw, does it have rdrand, ...

Comment 3 Tomas Mraz 2019-02-04 10:21:41 UTC

So actually Snapshot 2 had a known issue with low entropy on boot, could you please test a newer snapshot?

Comment 4 Yogita 2019-02-21 10:03:56 UTC

Hi Tomaz,

>> Also we need to know the exact details of the machine - is it virtual or real hw, does it have rdrand, ...

I tested the mentioned steps on my VirtualBox VM.

Not sure about rdrand here but.

Comment 5 Tomas Mraz 2019-02-21 11:05:17 UTC

Did you test anything newer than Snapshot 2?

Comment 6 Yogita 2019-02-21 12:31:09 UTC

>> Did you test anything newer than Snapshot 2?

By snapshot 2, you mean the latest RHEL8 release right? If yes, I'll do that soon and update you with my observation soon.

Comment 7 Yogita 2019-02-27 11:53:03 UTC

Hi Tomaz,

>> Did you test anything newer than Snapshot 2?

I believe you are talking about the Snapshot 2 mentioned in below link -
http://download.eng.pnq.redhat.com/pub/rhel/rel-eng/

I'm not really sure how to use the same as I can't see direct ISO for this. Can you please confirm what's your observation with Snapshot 2? Will be great if you can mention how to use the snapshot as well here.

Comment 10 Yogita 2019-04-03 12:36:29 UTC

I can confirm , this is now fixed in Snapshot 6. Thanks alot!

Comment 12 dpk 2020-02-26 14:51:57 UTC

Hi,
I am facing the similar issue in Aws Rhel8 image. As per audit requirement we asked to enable this fips-mode-setup --enable . AFter enabling and rebooting the AWS Redhat 8 ec2 vm the system doesn't come up. Even we have tried with 2 to 3 different AWS account and different location. it is same after reboot not coming up. Since AWS doesn;t have console option we couldn;t see where it got stuck. Does any one come across and fix this?