Hide Forgot
Description of problem: When updating EL6.2 GA selinux policy to selinux-policy-3.7.19-126.el6_2.4 in FIPS mode I see this error 1:selinux-policy ########################################### [ 9%] error parsing headers error parsing file /usr/share/selinux/devel/include/support/obj_perm_sets.spt: error:060800A0:digital envelope routines:EVP_DigestInit_ex:unknown cipher Version-Release number of selected component (if applicable): selinux-policy-3.7.19-126.el6_2.4 How reproducible: Should be 100% in our test scenario (see additional info) Steps to Reproduce: 1. Install RHEL6.2 GA and switch to FIPS mode 2. Update 3. Actual results: Error when updating Expected results: No error Additional info: Please note this bug was spotted during installation with custom kickstart we use for Common Criteria testing. The installation is in FIPS mode.
Steven? Eric? Any ideas?
Error is from sepolgen-ifgen. Digging a bit further, appears to trace back to sepolgen/yacc.py, which uses hashlib.md5(). fips mode kills md5? Bug 689387 looks similar but for a different program that uses md5.
So if we change this code to hashlib.sha256() it might work... It seems to work on Rawhide. Miroslav Vadkerti Can you change the code and try it again. # sed -i 's/md5/sha256/g' /usr/lib64/python2.7/site-packages/sepolgen/yacc.py # yum reinstall selinux-policy-targeted
I confirm that the change fixes the issue: # sed -i 's/md5/sha256/g' /usr/lib64/python2.6/site-packages/sepolgen/yacc.py # yum reinstall selinux-policy-* ... Running Transaction Installing : selinux-policy-3.7.19-126.el6_2.4.noarch 1/3 Installing : selinux-policy-targeted-3.7.19-126.el6_2.4.noarch 2/3 Installing : selinux-policy-mls-3.7.19-126.el6_2.4.noarch 3/3 Installed: selinux-policy.noarch 0:3.7.19-126.el6_2.4 selinux-policy-mls.noarch 0:3.7.19-126.el6_2.4 selinux-policy-targeted.noarch 0:3.7.19-126.el6_2.4 Complete!
Fixed in policycoreutils-2.0.83-19.20.el6_2
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: When installing packages on the system in (Federal Information Processing Standard (FIPS) mode, parsing errors could occur and installation failed. This was caused by the "/usr/lib64/python2.7/site-packages/sepolgen/yacc.py" parser, which used MD5 checksums that are not supported in FIPS mode. This update modifies the parser to use SHA-256 checksums and installation process is now successful.
Fixed in policycoreutils-2.0.83-19.24.el6
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2012-0969.html