Bug 2075388

Summary:	version of facter in rhel 9 does not work under fips
Product:	Red Hat OpenStack	Reporter:	Ade Lee <alee>
Component:	facter	Assignee:	Lon Hohberger <lhh>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	17.0 (Wallaby)	CC:	amoralej, apevec, hrybacki, jagee, lhh, tkajinam
Target Milestone:	---	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	leatherman-1.12.6-3.el9ost cpp-hocon-0.3.0-5.el9ost facter-3.14.19-1.el9ost	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-09-21 12:20:43 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Ade Lee 2022-04-14 05:00:51 UTC

Description of problem:

It looks like facter is linked against an older version of openssl.
When you run "puppet apply" or "factor", you get the following error:

crypto/fips/fips.c:154: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE

That failure comes from an older version of openssl, for instance:

https://github.com/openssl/openssl/blob/OpenSSL-fips-2_0-stable/fips/fips.c#L136-L142

whereas this file does not exist in latest versions of openssl.

We should note that:

1. puppet from upstream puppet works under fips mode, so we should consider updating here.

2. in centos-9 stream upstream, things appear to be working just fine.
see https://zuul.opendev.org/t/openstack/build/2d083f6b87a041d58466d11d303b948f/log/logs/undercloud/var/log/dnf.rpm.log  for instance.

Version-Release number of selected component (if applicable):

Red Hat Enterprise Linux release 9.0 Beta (Plow) 


How reproducible:


Steps to Reproduce:
1.  set RHEL 9 instance in FIPS mode
2.  puppet apply  or facter


Actual results:


Expected results:


Additional info:

Comment 1 Ade Lee 2022-04-14 05:05:00 UTC

FYI - this is holding up downstream testing for FIPS in OSP 17

Comment 4 Lon Hohberger 2022-04-25 19:44:01 UTC

I was able to get facter 3.14.19 rebuilt and run it in FIPS mode with Ruby enabled (ruby-facter) and not.

If all of its dependencies are not built in a particular order, it seems to cause issues.

Comment 17 errata-xmlrpc 2022-09-21 12:20:43 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Release of components for Red Hat OpenStack Platform 17.0 (Wallaby)), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2022:6543