Description of problem:
Default prelink configuration does not blacklist crypto binaries checked by fipscheck. Failing to blacklist these crypto binaries causes /etc/cron.daily/prelink to prelink the binaries, changing the hmac signature of the files and breaking their validation according to fipscheck.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Install base system
2. run /etc/cron.daily/prelink as root
3. FIPSCHECK_DEBUG=stderr fipscheck /usr/bin/fipscheck
fipscheck validation returns with error code 14 and stderr output indicates failure to initialize fips mode within openssl for /usr/bin/fipscheck
Return code 0 indicating binary matches corresponding hmac in /usr/bin/.fipscheck.hmac
Can be fixed by removing temporarily undoing the prelinking of the system by executing `prelink -au` then add the following to the tail of /etc/prelink.conf:
cat /etc/prelink.conf <<EOF
# the following binaries are blacklisted from prelinking due to
# their security relevance according to FIPS. Once deployed,
# they cannot be modified or their HMACs are no longer valid.
The next time the daily cron job is run, the system will be prelinked again without modifying fipscheck relevant binaries.
The removal of the blacklist was intentional, fipscheck is supposed to verify signatures of prelink -u -o - <library> rather than <library>.
No, that was not accepted by the FIPS certification lab. Currently all the security policies of the FIPS modules state that prelink must be switched off.
It also does not make any sense to prelink the binaries/libraries to undo the prelink later on each run of application that uses them anyway.
The guidance suggests switching it off completely, however the suggestion above would surely work as well. Unfortunately we cannot add this configuration as a default because it would unnecessarily make the binaries/libraries not prelinked even for non-FIPS configurations.
Excellent point that I did not consider due to the constraints of my present project. Thank you for your help.