Bug 1842838

Summary:	rpmlint reports crypto-policy-non-compliance-openssl
Product:	Red Hat Enterprise Linux 8	Reporter:	Ondrej Moriš <omoris>
Component:	tog-pegasus	Assignee:	Vitezslav Crhonek <vcrhonek>
Status:	CLOSED ERRATA	QA Contact:	Evgeny Fedin <efedin>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	8.2	CC:	djez, efedin
Target Milestone:	rc
Target Release:	8.0
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	tog-pegasus-2.14.1-46.el8	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-04 02:54:44 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1842847

Description Ondrej Moriš 2020-06-02 07:47:50 UTC

Description of problem:

Crypto-policy non-compliance is reported by rpmlint.

Since RHEL-8.0 we have system-wide crypto policies - usage of cryptographic protocols such as TLS that are enforced system-wide. In general we want all applications in RHEL to be compliant with the crypto policy set on the system (see policy [1] inherited from Fedora).

Rpmlint detected that tog-pegasus-libs uses SSL_CTX_set_cipher_list from OpenSSL library without PROFILE=SYSTEM. This indicates that a custom setting is used rather than system-wide crypto-policies setting. It is not a problem as long as it is intentional (e.g. specific algorithm is requested by user or configuration). However, unintentional usage might be a potential bug.

Could you please inspect relevant parts of the code, check that this is not rpmlint false positive and verify that custom setting is used intentionally?

* If yes, feel free to close this BZ as NOT-A-BUG.
* If not, could you please consider using system-wide crypto policy setting (PROFILE=SYSTEM) instead of custom setting?

[1] https://docs.fedoraproject.org/en-US/packaging-guidelines/CryptoPolicies

Version-Release number of selected component (if applicable):

tog-pegasus-2.14.1-45.el8

How reproducible:

100%

Steps to Reproduce:

1. rpmlint tog-pegasus-libs-2.14.1-45.el8.x86_64.rpm

Expected results:

No crypto-policy-non-compliance warning.

Actual results:

tog-pegasus-libs.x86_64: W: crypto-policy-non-compliance-openssl /usr/lib64/libpegcommon.so.1 SSL_CTX_set_cipher_list

Comment 1 Vitezslav Crhonek 2020-06-24 08:35:14 UTC

pegasus/src/Pegasus/Common/SSLContext.cpp:

...
    if (_cipherSuite.size() != 0)
    {
        if (!(SSL_CTX_set_cipher_list(sslContext, _cipherSuite.getCString())))
        {
...

This is the place where SSL_CTX_set_cipher_list function is called. _cipherSuite value
is taken from cimserver's sslCipherSuite option. Users can change the option, but there's
default value used if they don't:

# cimconfig -g sslCipherSuite
Current value: DEFAULT

(For more information see man cimconfig.)

Should the default sslCipherSuite value be changed to 'PROFILE=SYSTEM' instead of 'DEFAULT'
to be compliant with the crypto policy?

Comment 2 Ondrej Moriš 2020-06-24 08:46:15 UTC

DEFAULT is openssl built-in value different from PROFILE=SYSTEM and hence, yes, I believe that needs to be corrected. If sysadmin changes the system policy, DEFAULT value of openssl doesn't reflect that change and that might potentially cause problems for TLS connection.

Comment 3 Vitezslav Crhonek 2020-06-24 08:51:48 UTC

OK, thanks.

Comment 8 Ondrej Moriš 2020-08-06 13:06:57 UTC

Verified with tog-pegasus-2.14.1-46.el8. Even though rpmlint reports still reports the same issue:

# rpmlint tog-pegasus-libs-2.14.1-46.el8.i686.rpm 2>&1 | grep crypto-policy-non-compliance
tog-pegasus-libs.i686: W: crypto-policy-non-compliance-openssl /usr/lib/libpegcommon.so.1 SSL_CTX_set_cipher_list

it is not false positive. As noted above, SSL_CTX_set_cipher_list is parametrized in this case and default options was updated from DEFAULT to PROFILE=SYSTEM and hence if there is no custom setting, crypto-policies setting is used.

Comment 9 Ondrej Moriš 2020-08-06 13:07:47 UTC

(In reply to Ondrej Moriš from comment #8)
> ...
> it is not false positive
> ...

Sorry, I meant "it is NOW a false positive".

Comment 13 errata-xmlrpc 2020-11-04 02:54:44 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (tog-pegasus bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4678