Bug 2119822

Summary:	regression: "GnuTLS initialization: Error while performing self checks" with LD_LIBRARY_PATH (FIPS enabled)
Product:	Red Hat Enterprise Linux 9	Reporter:	Damien Ciabrini <dciabrin>
Component:	gnutls	Assignee:	Daiki Ueno <dueno>
Status:	CLOSED WORKSFORME	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	high	Docs Contact:
Priority:	high
Version:	9.0	CC:	apevec, dciabrin, dueno, dviroel
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-10-03 04:46:10 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Damien Ciabrini 2022-08-19 13:52:35 UTC

Description of problem:
When FIPS mode is enabled, GnUTLS fails to initialize correctly when /usr/lib64 is present in LD_LIBRARY_PATH. This used to work in previous versions. 

Version-Release number of selected component (if applicable):
gnutls 3.7.6-4.el9
gnutls-utils 3.7.6-4.el9

How reproducible:
Always

Steps to Reproduce:
1. Enable FIPS mode:
   # fips-mode-setup --enable && reboot

2. Execute any gnutls application with /usr/lib64 in LD_LIBRARY_PATH
   # LD_LIBRARY_PATH=/usr/lib64 gnutls-cli-debug

Actual results:
gnutls cannot initialize

# LD_LIBRARY_PATH=/usr/lib64 gnutls-cli-debug 
Error in GnuTLS initialization: Error while performing self checks.
global state initialization error


Expected results:
initialization should work

# LD_LIBRARY_PATH=/usr/lib64 gnutls-cli-debug 
GnuTLS debug client 3.7.3
Checking localhost:443


Additional info:
This used to work with GnuTLS 3.7.3-10 and below

Comment 7 Daiki Ueno 2022-08-30 11:43:23 UTC

The mismatch should be resolved after nettle-3.8-3.el9 and gnutls-3.7.6-11.el9 go into the compose. They are already tagged as c9s-candidate:
https://kojihub.stream.centos.org/koji/buildinfo?buildID=24827
https://kojihub.stream.centos.org/koji/buildinfo?buildID=24826