From d153cfda59156f18fdff89a3f3ac2f01fe95767e Mon Sep 17 00:00:00 2001 From: Matus Marhefka Date: Tue, 14 Jan 2025 13:53:06 +0100 Subject: [PATCH] Update enable_fips_mode for bootable containers This commit extends rule `enable_fips_mode` for bootable containers. To enable FIPS mode at bootable container build time we need to configure `fips=1` kernel argument through a configuration file in `/usr/lib/bootc/kargs.d/` directory and set the cryptographic policy to `FIPS`. The OVAL check of the rule has also been updated to distinguish between bootable container build environment and other environments. For more details see: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10-beta/html/using_image_mode_for_rhel_to_build_deploy_and_manage_operating_systems/enabling-the-fips-mode-while-building-a-bootc-image#enabling-the-fips-mode-while-building-a-bootc-image --- .../fips/enable_fips_mode/bash/shared.sh | 11 +- .../fips/enable_fips_mode/oval/shared.xml | 111 +++++++++++++----- .../integrity/fips/enable_fips_mode/rule.yml | 13 +- .../oval/installed_env_is_a_container.xml | 32 +++++ 4 files changed, 133 insertions(+), 34 deletions(-) create mode 100644 shared/checks/oval/installed_env_is_a_container.xml diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/bash/shared.sh b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/bash/shared.sh index f3605345bbb..113f57e75a4 100644 --- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/bash/shared.sh +++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/bash/shared.sh @@ -1,9 +1,16 @@ # platform = multi_platform_all {{{ bash_instantiate_variables("var_system_crypto_policy") }}} -fips-mode-setup --enable +if {{{ bash_bootc_build() }}}; then + crypto_policies_no_reload="--no-reload" + cat > /usr/lib/bootc/kargs.d/01-fips.toml << EOF +kargs = ["fips=1"] +EOF +else + fips-mode-setup --enable +fi -stderr_of_call=$(update-crypto-policies --set ${var_system_crypto_policy} 2>&1 > /dev/null) +stderr_of_call=$(update-crypto-policies $crypto_policies_no_reload --set ${var_system_crypto_policy} 2>&1 > /dev/null) rc=$? if test "$rc" = 127; then diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml index 267fc6b0df7..fa7a4a7378a 100644 --- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml +++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/oval/shared.xml @@ -1,45 +1,94 @@ {{{ oval_metadata("Check if FIPS mode is enabled on the system") }}} - - - - {{%- if product not in ["rhel10"] -%}} - - {{%- endif -%}} - - - {{% if "ol" in product or "rhel" in product %}} - - - - + + {{% if bootable_containers_supported == "true" %}} + + + + + {{%- if product not in ["rhel10"] -%}} + + {{%- endif -%}} + + + + + {{% endif %}} + + + {{% if bootable_containers_supported == "true" %}} + + + + + + - - + {{% endif %}} + + + {{%- if product not in ["rhel10"] -%}} + + {{%- endif -%}} + + + {{% if "ol" in product or "rhel" in product %}} + + + comment="generic test for s390x architecture"/> + + + + + + + {{% if product in ["ol8", "rhel8"] %}} + + {{% else %}} + + {{% endif %}} - {{% if product in ["ol8", "rhel8"] %}} - - {{% else %}} - - {{% endif %}} + {{% endif %}} - {{% endif %}} + {{% if bootable_containers_supported == "true" %}} + {{% endif %}} + + + + + + + /usr/lib/bootc/kargs.d/ + ^.*\.toml$ + ^kargs[\s]*=[\s]*\[([^\]]+)\]$ + 1 + + + + ^.*"[\s]*fips[\s]*=[\s]*1[\s]*".*$ + + diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml index 29cafb8cc04..a746494d3fe 100644 --- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml +++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/rule.yml @@ -1,6 +1,5 @@ documentation_complete: true - title: Enable FIPS Mode description: |- @@ -16,6 +15,13 @@ description: |-
  • Setting the system crypto policy in /etc/crypto-policies/config to {{{ xccdf_value("var_system_crypto_policy") }}}
  • Loading the Dracut fips module
    • + +
    + To enable FIPS mode at bootable container build time configure fips=1 kernel argument + in /usr/lib/bootc/kargs.d/01-fips.toml: + 
    kargs = ["fips=1"]
    + Then set the cryptographic policy to {{{ xccdf_value("var_system_crypto_policy") }}}: + 
    update-crypto-policies --no-reload --set {{{ xccdf_value("var_system_crypto_policy") }}}
    {{% else %}} OpenShift has an installation-time flag that can enable FIPS mode for the cluster. The flag 
    fips: true
    must be enabled @@ -78,4 +84,9 @@ fixtext: |- The system needs to be rebooted for these changes to take effect. + To enable FIPS mode at bootable container build time, add the following commands in Containerfile: + + RUN echo 'kargs = ["fips=1"]' > /usr/lib/bootc/kargs.d/01-fips.toml + RUN update-crypto-policies --no-reload --set {{{ xccdf_value("var_system_crypto_policy") }}} + srg_requirement: '{{{ full_name }}} must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.' diff --git a/shared/checks/oval/installed_env_is_a_container.xml b/shared/checks/oval/installed_env_is_a_container.xml new file mode 100644 index 00000000000..c1ec0159e23 --- /dev/null +++ b/shared/checks/oval/installed_env_is_a_container.xml @@ -0,0 +1,32 @@ + + + + Check if the scan target is a container + + multi_platform_all + + Check for presence of files characterizing container filesystems. + + + + + + + + + + + + + + /.dockerenv + + + + + + + + /run/.containerenv + +