Description of problem: Steve Grubb says: If you are booting in FIPS mode on 8.4 or later, you get the jitterentropy source instead of the interrupt driven LRNG. Rngd cannot seed the jitterentropy source, so it is not needed. So it would be appropriate to disable rngd as part of "fips-mode-setup --enable" in case it was enabled. Version-Release number of selected component (if applicable): crypto-policies-scripts-20220815-1.git0fbe86f.el9
Would it make more sense to instead disable it with a `ConditionKernelCommandLine=!fips=1` in rngd unit file?
Thanks, that indeed might be a better approach than disabling the service once in a script.
Marko, would it make sense then to change the Component field of this bugzilla to rng-tools?
i will update rngd's unit file in the upcoming release (bz2141379 bz2156554), thank you for a research and a solution.
systemctl status reports in FIPS mode: + rngd.service - Hardware RNG Entropy Gatherer Daemon Condition: start condition failed at Thu 2022-12-29 11:17:43 EST; 2min 41s ago └─ ConditionKernelCommandLine=!fips=1 was not met Main PID: 180 (code=exited, status=0/SUCCESS) Dec 29 11:17:43 s390x-kvm-023.lab.eng.rdu2.redhat.com systemd[1]: Hardware RNG Entropy Gatherer Daemon was skipped because of an unmet condition check (ConditionKernelCommandLine=!fips=1).
now dracut should do the same for initramfs service file: # rpm -qf /usr/lib/dracut/modules.d/06rngd/rngd.service dracut-049-218.git20221019
(In reply to Vladis Dronov from comment #6) > i will update rngd's unit file in the upcoming release (bz2141379 bz2156554), thank you for a research and a solution. rng-tools were updated in: rng-tools-6.15-3.el8 rng-tools-6.15-3.el9