Bug 2154804

Summary:	RFE: Disable rngd as part of fips-mode-setup
Product:	Red Hat Enterprise Linux 9	Reporter:	Marko Myllynen <myllynen>
Component:	crypto-policies	Assignee:	Alexander Sosedkin <asosedki>
Status:	CLOSED DUPLICATE	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.1	CC:	jpazdziora, vdronov
Target Milestone:	rc	Keywords:	FutureFeature
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-01-10 16:45:59 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Marko Myllynen 2022-12-19 10:16:03 UTC

Description of problem:
Steve Grubb says:

If you are booting in FIPS mode on 8.4 or later, you get the jitterentropy source instead of the interrupt driven LRNG. Rngd cannot seed the jitterentropy source, so it is not needed.

So it would be appropriate to disable rngd as part of "fips-mode-setup --enable" in case it was enabled.

Version-Release number of selected component (if applicable):
crypto-policies-scripts-20220815-1.git0fbe86f.el9

Comment 3 Alexander Sosedkin 2022-12-19 10:31:47 UTC

Would it make more sense to instead disable it
with a `ConditionKernelCommandLine=!fips=1` in rngd unit file?

Comment 4 Marko Myllynen 2022-12-19 10:43:38 UTC

Thanks, that indeed might be a better approach than disabling the service once in a script.

Comment 5 Jan Pazdziora (Red Hat) 2022-12-28 19:33:32 UTC

Marko, would it make sense then to change the Component field of this bugzilla to rng-tools?

Comment 6 Vladis Dronov 2022-12-29 15:16:30 UTC

i will update rngd's unit file in the upcoming release (bz2141379 bz2156554), thank you for a research and a solution.

Comment 7 Vladis Dronov 2022-12-29 16:25:36 UTC

systemctl status reports in FIPS mode:

+ rngd.service - Hardware RNG Entropy Gatherer Daemon
  Condition: start condition failed at Thu 2022-12-29 11:17:43 EST; 2min 41s ago
             └─ ConditionKernelCommandLine=!fips=1 was not met
   Main PID: 180 (code=exited, status=0/SUCCESS)
Dec 29 11:17:43 s390x-kvm-023.lab.eng.rdu2.redhat.com systemd[1]: Hardware RNG Entropy Gatherer Daemon was skipped because of an unmet condition check (ConditionKernelCommandLine=!fips=1).

Comment 8 Vladis Dronov 2022-12-29 17:59:44 UTC

now dracut should do the same for initramfs service file:

# rpm -qf /usr/lib/dracut/modules.d/06rngd/rngd.service 
dracut-049-218.git20221019

Comment 9 Vladis Dronov 2023-01-06 15:02:44 UTC

(In reply to Vladis Dronov from comment #6)
> i will update rngd's unit file in the upcoming release (bz2141379 bz2156554), thank you for a research and a solution.

rng-tools were updated in: rng-tools-6.15-3.el8 rng-tools-6.15-3.el9