| Summary: | prelink-0.4.4-1.el6 conflicts with fipscheck-1.2.0-5.el6 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Charles Stewart <ccstewart> |
| Component: | fipscheck | Assignee: | Tomas Mraz <tmraz> |
| Status: | CLOSED WONTFIX | QA Contact: | BaseOS QE Security Team <qe-baseos-security> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 6.1 | ||
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-09-15 14:56:57 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
The removal of the blacklist was intentional, fipscheck is supposed to verify signatures of prelink -u -o - <library> rather than <library>. No, that was not accepted by the FIPS certification lab. Currently all the security policies of the FIPS modules state that prelink must be switched off. It also does not make any sense to prelink the binaries/libraries to undo the prelink later on each run of application that uses them anyway. The guidance suggests switching it off completely, however the suggestion above would surely work as well. Unfortunately we cannot add this configuration as a default because it would unnecessarily make the binaries/libraries not prelinked even for non-FIPS configurations. Excellent point that I did not consider due to the constraints of my present project. Thank you for your help. |
Description of problem: Default prelink configuration does not blacklist crypto binaries checked by fipscheck. Failing to blacklist these crypto binaries causes /etc/cron.daily/prelink to prelink the binaries, changing the hmac signature of the files and breaking their validation according to fipscheck. Version-Release number of selected component (if applicable): prelink-0.4.4-1.el6 How reproducible: Every time. Steps to Reproduce: 1. Install base system 2. run /etc/cron.daily/prelink as root 3. FIPSCHECK_DEBUG=stderr fipscheck /usr/bin/fipscheck Actual results: fipscheck validation returns with error code 14 and stderr output indicates failure to initialize fips mode within openssl for /usr/bin/fipscheck Expected results: Return code 0 indicating binary matches corresponding hmac in /usr/bin/.fipscheck.hmac Additional info: Can be fixed by removing temporarily undoing the prelinking of the system by executing `prelink -au` then add the following to the tail of /etc/prelink.conf: cat /etc/prelink.conf <<EOF # the following binaries are blacklisted from prelinking due to # their security relevance according to FIPS. Once deployed, # they cannot be modified or their HMACs are no longer valid. -b /lib{,64}/libcryptsetup.so* -b /lib{,64}/libgcrypt.so* -b /lib{,64}/libfipscheck.so* -b /usr/lib{,64}/libcrypto.so* -b /usr/lib{,64}/libssl.so* -b /sbin/cryptsetup -b /usr/bin/fipscheck -b /usr/bin/openssl -b /usr/sbin/sshd -b /usr/bin/ssh -b /usr/bin/ssh-add -b /usr/bin/ssh-agent -b /usr/bin/ssh-keygen -b /usr/bin/ssh-keyscan EOF The next time the daily cron job is run, the system will be prelinked again without modifying fipscheck relevant binaries.