Bug 2189928

Summary:	disabling fips results in inconsistent state
Product:	Red Hat Enterprise Linux 9	Reporter:	Pradeep Jagtap <prjagtap>
Component:	crypto-policies	Assignee:	Alexander Sosedkin <asosedki>
Status:	CLOSED WONTFIX	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	9.1
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-04-26 13:51:24 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Pradeep Jagtap 2023-04-26 13:21:43 UTC

Description of problem:
disabling fips results in inconsistent state

Version-Release number of selected component (if applicable):
crypto-policies-20220815-1.git0fbe86f.el9.noarch

How reproducible:


Steps to Reproduce:
1. Boot the system.
2. Enable FIPS mode (fips-mode-setup --enable).
3. Reboot the system.
4. Check FIPS mode (fips-mode-setup --check).
5. Disable FIPS mode (fips-mode-setup --disable).
6. Reboot the system.
7. Check FIPS mode (fips-mode-setup --check).


Actual results:
# fips-mode-setup --check 
FIPS mode is disabled.
Inconsistent state detected.

Expected results:
# fips-mode-setup --check 
FIPS mode is disabled.

Comment 3 Alexander Sosedkin 2023-04-26 13:51:24 UTC

This is known and documented as unsupported.

man fips-mode-setup

OPTIONS
       The following options are available in fips-mode-setup tool.

       •   --enable: Enables the system FIPS mode.

       •   --disable: Undo some of the FIPS-enablement steps (unsupported).


At the very least, the steps that aren't undone are:
# rm /etc/dracut.conf.d/40-fips.conf /etc/system-fips
# dracut -f --regenerate-all