FIPS Question for EL8

Latest response

We're about to undertake the process of moving our tenants from RHEL7 to RHEL8 (yeah, not a minute too soon). While our standardize build processes enable FIPS mode by default, some of our tenants have previously needed to disable FIPS due to incompatibilities with some of their applications. Previously, that was "just" a process of "remove the FIPS kernel RPM, update Grubby and reboot". With EL8+, that process changes

One of our early-adopter tenants used their provisioning-time automation for their RHEL7 VMs unaltered against a RHEL8 test-VM. It put the system in an aesthetically-interesting state:

$ cat /etc/os-release
NAME="Red Hat Enterprise Linux"
VERSION="8.8 (Ootpa)"
ID="rhel"
ID_LIKE="fedora"
VERSION_ID="8.8"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Red Hat Enterprise Linux 8.8 (Ootpa)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:redhat:enterprise_linux:8::baseos"
HOME_URL="https://www.redhat.com/"
DOCUMENTATION_URL="https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8"
BUG_REPORT_URL="https://bugzilla.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 8"
REDHAT_BUGZILLA_PRODUCT_VERSION=8.8
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="8.8"

sh-4.4$ sudo -i
[root@ip-0A0044F2 ~]# fips-mode-setup --check
FIPS mode is disabled.

[root@ip-0A0044F2 ~]# cat /proc/sys/crypto/fips_enabled
0

[root@ip-0A0044F2 ~]# update-crypto-policies --show
FIPS

They haven't yet tested yet to see if disabling FIPS mode will still be required (with a platform migration, they can revisit their app to see if its requirements change). My assumption from the above is that, while the kernel is no-longer blacklisting FIPS-violating capabilities, the continued crypto-policy state means that the various components with behaviors mediated through /usr/share/crypto-policies/back-ends/ will continue to act as though FIPS is enabled?

Just wondering how "squirrely" the system is likely to act for them. Anyone have any insight?

Responses