Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 2026879

Summary:	When run with fips=1, anaconda resets FIPS crypto policy module set by an addon
Product:	Red Hat Enterprise Linux 9	Reporter:	Jan Pazdziora (Red Hat) <jpazdziora>
Component:	anaconda	Assignee:	Anaconda Maintenance Team <anaconda-maint-list>
Status:	CLOSED MIGRATED	QA Contact:	Release Test Team <release-test-team-automation>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	jkonecny, jpazdziora, jstodola, mepley, vpolasek
Target Milestone:	rc	Keywords:	MigratedToJIRA, Reopened, Triaged
Target Release:	---	Flags:	pm-rhel: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-09-18 15:17:51 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Pazdziora (Red Hat) 2021-11-26 10:32:19 UTC

Description of problem:

When anaconda is booted with fips=1 kernel command line parameter, it ultimately invokes fips-mode-setup --enable --no-bootcfg to enable the FIPS mode in the provisioned environment as well.

It does so even when some addon has already configured FIPS mode which itself wouldn't be a problem.

However, when the addon also configured the crypto policy to be a module of FIPS policy, for example FIPS:OSPP, that fips-mode-setup --enable will flip the policy back to the "core" FIPS.

So anaconda effectively resets the work that the addon has already done.

Version-Release number of selected component (if applicable):

/var/log/anaconda/anaconda.log says
10:19:17,404 INF main: /sbin/anaconda 34.25.0.20-1.el9

How reproducible:

Deterministic.

Steps to Reproduce:
1. Have a RHEL kickstart with the following specific changes:

# Comment out autopart or the following part commands will not work
# autopart

# Anaconda like these to exist
part / --size 3000 --fstype xfs
part /boot --size 500 --fstype xfs

# The OSPP SCAP profile when processed with com_redhat_oscap addon
# insists that these partitions exist, or installation does not continue
part /var --recommended --fstype xfs
part /var/log --recommended --fstype xfs
part /var/log/audit --size 500 --fstype xfs
part /var/tmp --recommended --fstype xfs
part /home --size 500 --fstype xfs
part /tmp --size 500 --fstype tmpfs

# OSPP profile disables root's ssh logons, this might be needed if remote
# access desired
# user --name test2 --plaintext --password Secret123 --uid 5678
# %post
# echo "test2 ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
# %end

# Invoke configuring the system using the OSPP SCAP profile
%addon com_redhat_oscap
  content-type = scap-security-guide
  profile = ospp
%end

2. Run anaconda with fips=1 kernel command line parameter.
3. On the system, run
   fips-mode-setup --check ; update-crypto-policies --show ; update-crypto-policies --check

Actual results:

FIPS mode is enabled.
FIPS
The configured policy is applied

Expected results:

FIPS mode is enabled.
FIPS:OSPP
The configured policy is applied

Additional info:

The expected result comes from the same kickstart being used but without the fips=1 kernel command line parameter.

The OSPP SCAP profile used by the com_redhat_oscap addon has rules xccdf_org.ssgproject.content_rule_enable_fips_mode and xccdf_org.ssgproject.content_rule_configure_crypto_policy that enable FIPS mode but also configure the crypto policy to FIPS:OSPP, instead of the default (for FIPS mode) FIPS.

Anaconda should not override that work.

Comment 1 Jan Pazdziora (Red Hat) 2021-11-26 10:38:52 UTC

Looking at the upstream code at https://github.com/rhinstaller/anaconda/, security_proxy.ConfigureFIPSWithTask() is added to configuration_queue via

https://github.com/rhinstaller/anaconda/blob/master/pyanaconda/installation.py#L174

after the addons got added in

https://github.com/rhinstaller/anaconda/blob/master/pyanaconda/installation.py#L152

And the FIPS mode enablement is done using unconditional fips-mode-setup --enable --no-bootcfg

https://github.com/rhinstaller/anaconda/blob/master/pyanaconda/modules/security/installation.py#L167-L171

One hopefully quick way to fix the problem would be to run something like

  fips-mode-setup --is-enabled

in that ConfigureFIPSTask's run, and if already enabled, skip that

  fips-mode-setup --enable --no-bootcfg

invocation.

But the issue also brings a more general question -- is it correct that the SECURITY module is only invoked after the addons? IOW, shouldn't the addons be in the queue after that SECURITY module was called, so that they already operate on the "hardened" setup?

Comment 3 Jiri Konecny 2021-12-08 14:32:07 UTC

Proposing for 9.1 planning.

Comment 5 Jan Stodola 2022-09-23 11:37:58 UTC

The problem is not reproducible on RHEL-9.1, most likely due to a fix in bug 2026657.

(In reply to Jan Pazdziora from comment #1)

> But the issue also brings a more general question -- is it correct that the
> SECURITY module is only invoked after the addons? IOW, shouldn't the addons
> be in the queue after that SECURITY module was called, so that they already
> operate on the "hardened" setup?

The "Configure FIPS" task is executed as about 44th task out of 48 during the installation. It would make sense to execute it as soon as possible so that not only addons are executed in a properly configured environment. What do you think, Jirko?

Comment 6 Jiri Konecny 2022-09-23 15:08:39 UTC

From the implementation PoV it's simple. Hard part is to be sure that we won't break something else which depends on the previous setup...

Looking on the code and the queue is:

- Create users
- Configuring addons
- Generating initramfs
- Configure FIPS

My question is if we can move initramfs generation after the FIPS? Couldn't that raise any issue?

Comment 7 Jan Stodola 2022-09-23 15:17:18 UTC

initramfs generation has to work in FIPS mode and with the environment properly set up - like on an installed FIPS system when installing a new kernel.

Comment 8 Jiri Konecny 2022-09-30 09:47:09 UTC

I would like to do this change upstream first.

Comment 11 RHEL Program Management 2023-05-26 07:28:20 UTC

After evaluating this issue, there are no plans to address it further or fix it in an upcoming release.  Therefore, it is being closed.  If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened.

Comment 12 Jan Pazdziora (Red Hat) 2023-05-31 14:47:42 UTC

(In reply to Jiri Konecny from comment #8)
> I would like to do this change upstream first.

Hello Jiří, were you able to get the change tested upstream?

Comment 13 Jiri Konecny 2023-06-01 08:38:54 UTC

Hi, unfortunately no. We definitely want to get this upstream first but we are a bit overburden with other high priority tasks.

Jirka

Comment 16 RHEL Program Management 2023-09-18 15:16:11 UTC

Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug.

Comment 17 RHEL Program Management 2023-09-18 15:17:51 UTC

This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there.

Due to differences in account names between systems, some fields were not replicated.  Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information.

To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer.  You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like:

"Bugzilla Bug" = 1234567

In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information.