Bug 738687 - prelink-0.4.4-1.el6 conflicts with fipscheck-1.2.0-5.el6
Summary: prelink-0.4.4-1.el6 conflicts with fipscheck-1.2.0-5.el6
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: fipscheck
Version: 6.1
Hardware: All
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Tomas Mraz
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-09-15 14:29 UTC by Charles Stewart
Modified: 2011-09-15 15:09 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-09-15 14:56:57 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Charles Stewart 2011-09-15 14:29:28 UTC
Description of problem:

Default prelink configuration does not blacklist crypto binaries checked by fipscheck.  Failing to blacklist these crypto binaries causes /etc/cron.daily/prelink to prelink the binaries, changing the hmac signature of the files and breaking their validation according to fipscheck.

Version-Release number of selected component (if applicable):

prelink-0.4.4-1.el6

How reproducible:

Every time.

Steps to Reproduce:
1. Install base system
2. run /etc/cron.daily/prelink as root
3. FIPSCHECK_DEBUG=stderr fipscheck /usr/bin/fipscheck
  
Actual results:

fipscheck validation returns with error code 14 and stderr output indicates failure to initialize fips mode within openssl for /usr/bin/fipscheck

Expected results:

Return code 0 indicating binary matches corresponding hmac in /usr/bin/.fipscheck.hmac

Additional info:

Can be fixed by removing temporarily undoing the prelinking of the system by executing `prelink -au` then add the following to the tail of /etc/prelink.conf:

cat /etc/prelink.conf <<EOF
# the following binaries are blacklisted from prelinking due to
# their security relevance according to FIPS.  Once deployed,
# they cannot be modified or their HMACs are no longer valid.
-b /lib{,64}/libcryptsetup.so*
-b /lib{,64}/libgcrypt.so*
-b /lib{,64}/libfipscheck.so*
-b /usr/lib{,64}/libcrypto.so*
-b /usr/lib{,64}/libssl.so*
-b /sbin/cryptsetup
-b /usr/bin/fipscheck
-b /usr/bin/openssl
-b /usr/sbin/sshd
-b /usr/bin/ssh
-b /usr/bin/ssh-add
-b /usr/bin/ssh-agent
-b /usr/bin/ssh-keygen
-b /usr/bin/ssh-keyscan
EOF

The next time the daily cron job is run, the system will be prelinked again without modifying fipscheck relevant binaries.

Comment 2 Jakub Jelinek 2011-09-15 14:42:06 UTC
The removal of the blacklist was intentional, fipscheck is supposed to verify signatures of prelink -u -o - <library> rather than <library>.

Comment 3 Tomas Mraz 2011-09-15 14:56:57 UTC
No, that was not accepted by the FIPS certification lab. Currently all the security policies of the FIPS modules state that prelink must be switched off.

It also does not make any sense to prelink the binaries/libraries to undo the prelink later on each run of application that uses them anyway.

The guidance suggests switching it off completely, however the suggestion above would surely work as well. Unfortunately we cannot add this configuration as a default because it would unnecessarily make the binaries/libraries not prelinked even for non-FIPS configurations.

Comment 4 Charles Stewart 2011-09-15 15:09:08 UTC
Excellent point that I did not consider due to the constraints of my present project.  Thank you for your help.


Note You need to log in before you can comment on or make changes to this bug.