Description of problem:

Default prelink configuration does not blacklist crypto binaries checked by fipscheck.  Failing to blacklist these crypto binaries causes /etc/cron.daily/prelink to prelink the binaries, changing the hmac signature of the files and breaking their validation according to fipscheck.

Version-Release number of selected component (if applicable):

prelink-0.4.4-1.el6

How reproducible:

Every time.

Steps to Reproduce:
1. Install base system
2. run /etc/cron.daily/prelink as root
3. FIPSCHECK_DEBUG=stderr fipscheck /usr/bin/fipscheck
  
Actual results:

fipscheck validation returns with error code 14 and stderr output indicates failure to initialize fips mode within openssl for /usr/bin/fipscheck

Expected results:

Return code 0 indicating binary matches corresponding hmac in /usr/bin/.fipscheck.hmac

Additional info:

Can be fixed by removing temporarily undoing the prelinking of the system by executing `prelink -au` then add the following to the tail of /etc/prelink.conf:

cat /etc/prelink.conf <<EOF
# the following binaries are blacklisted from prelinking due to
# their security relevance according to FIPS.  Once deployed,
# they cannot be modified or their HMACs are no longer valid.
-b /lib{,64}/libcryptsetup.so*
-b /lib{,64}/libgcrypt.so*
-b /lib{,64}/libfipscheck.so*
-b /usr/lib{,64}/libcrypto.so*
-b /usr/lib{,64}/libssl.so*
-b /sbin/cryptsetup
-b /usr/bin/fipscheck
-b /usr/bin/openssl
-b /usr/sbin/sshd
-b /usr/bin/ssh
-b /usr/bin/ssh-add
-b /usr/bin/ssh-agent
-b /usr/bin/ssh-keygen
-b /usr/bin/ssh-keyscan
EOF

The next time the daily cron job is run, the system will be prelinked again without modifying fipscheck relevant binaries.