Bug 2179891 - Unable to run fipsinstall
Summary: Unable to run fipsinstall
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: openssl
Version: 38
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Dmitry Belyavskiy
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-03-20 10:53 UTC by Jan Grulich
Modified: 2023-03-20 11:08 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2023-03-20 11:08:19 UTC
Type: Bug
Embargoed:
fedora-admin-xmlrpc: mirror+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FC-789 0 None None None 2023-03-20 10:56:42 UTC

Description Jan Grulich 2023-03-20 10:53:50 UTC
Description of problem:
I'm unable to run fipsinstall to install the FIPS module. 

Getting:
This command is not enabled in the Red Hat Enterprise Linux OpenSSL build, please consult Red Hat documentation to learn how to enable FIPS mode.

This looks wrong as I don't use RHEL build, this is on Fedora (Kinoite) 38 running Fedora 38 in a container. I was happily using this on Fedora 37 before (with F37 container).

Version-Release number of selected component (if applicable):
openssl-3.0.8-1.fc38.x86_64

How reproducible:
Run fipinstall, for example:
sudo openssl fipsinstall -out /usr/local/ssl/fipsmodule.cnf -module /usr/lib64/ossl-modules/fips.so

Comment 1 Jan Grulich 2023-03-20 11:04:06 UTC
It looks this patch https://src.fedoraproject.org/rpms/openssl/blob/f38/f/0034.fipsinstall_disable.patch has been applied in F38 and Rawhide, while it doesn't exist in Fedora 37. I guess it was brought from RHEL (during sync) and it's just missing a condition to avoid using it on Fedora?

Comment 2 Clemens Lang 2023-03-20 11:08:19 UTC
This is expected, we're shipping the same patches RHEL uses in Fedora. Please switch the entire Fedora system into FIPS mode using `fips-mode-setup --enable`.

Note that we do not FIPS-certify Fedora, and it also currently lags behind some of the FIPS compliance patches applied to RHEL (although we will eventually be pushing all FIPS patches into Fedora as well).

We do not plan to conditionally apply the FIPS patches to RHEL only.


Note You need to log in before you can comment on or make changes to this bug.