Bug 1957310
| Summary: | FIPS mode is not being enabled in containers | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Juan Antonio Osorio <josorior> |
| Component: | Node | Assignee: | Urvashi Mohnani <umohnani> |
| Node sub component: | CRI-O | QA Contact: | Sunil Choudhary <schoudha> |
| Status: | CLOSED NOTABUG | Docs Contact: | |
| Severity: | high | ||
| Priority: | unspecified | CC: | aos-bugs, danken, dcaspin, fdeutsch, jhrozek, josorior, mfiedler, miabbott, nagrawal, ssorce, xiyuan, xtian |
| Version: | 4.8 | ||
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-05-10 05:52:24 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Juan Antonio Osorio
2021-05-05 15:02:34 UTC
Urvashi, can you PTAL Please DO NOT use update-crypto-policies --show to check if your system is in FIPS mode. That command only shows whatthe *crypto policies* are, but tells nothing on whether the system is correctly in fips mode. Please check if /proc/sys/crypto/fips_enabled is 1 That is the only real indicator that the system is in fips mode, and the only indicator crypto libraries use to switch to FIPS mode. The FIPs crypto policisy is just an additional helper and users are totally allowed to even create their own completely custom policy and name it anything and still be fips compliant. Please change your tests to reflect above (and documentation as well if necessary). Thanks @Simo! From the description we see that /proc/sys/crypto/fips_enabled is set to 1, so the container is in FIPS mode as it should be. I saw the same thing on a 4.7 and 4.8 cluster in FIPS mode when testing this out. Another tool I used was `fips-mode-setup --check` and it showed that FIPS mode was enabled in the container. The update-crypto-policies tool needs to be updated to be able to correctly determine the policy being used in the container based on the information available inside the container. @Juan, will close this as not a bug unless there is anything else? Nope. We're good! Thanks for the clarification! (In reply to Simo Sorce from comment #4) > Please DO NOT use update-crypto-policies --show to check if your system is > in FIPS mode. > That command only shows whatthe *crypto policies* are, but tells nothing on > whether the system is correctly in fips mode. > > Please check if /proc/sys/crypto/fips_enabled is 1 > > That is the only real indicator that the system is in fips mode, and the > only indicator crypto libraries use to switch to FIPS mode. > The FIPs crypto policisy is just an additional helper and users are totally > allowed to even create their own completely custom policy and name it > anything and still be fips compliant. > > Please change your tests to reflect above (and documentation as well if > necessary). I am confused by the RHEL docs at https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening#enabling-fips-mode-in-a-container_using-the-system-wide-cryptographic-policies . It seems to suggest that the container runner has to mount /etc/system-fips and run `update-crypto-policies --set FIPS` inside the container before FIPS takes effect on the container processes. Should the docs be modified to something like "as long as your container uses compliant crypto libraries such as those supplied by UBI8 and the host has fips_enabled, the container code would comply with FIPS"? I closed this one, but I do suggest opening another bug against the RHEL docs. That's also what I was reading and where this confusion came from to begin with. Juan, Simo, would you help me outline the correct up-to-date RHEL docs? Is the following a reasonable begining? "as long as your container uses compliant crypto libraries such as those supplied by UBI8 and the host has fips_enabled, the container code would comply with FIPS" |