pool/crypto-policies
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 1108344 from home:pmonrealgonzalez:branches:security:tls

Browse Source 
- Tests: Fix pylint versioning for TW and fix the parsing of the
  policygenerators to account for the commented lines correctly.
  * Add crypto-policies-pylint.patch
  * Rebase crypto-policies-policygenerators.patch

- FIPS: Adapt the fips-mode-setup script to use the pbl command
  from the perl-Bootloader package to replace grubby. Add a note
  for transactional systems [jsc#PED-4578].
  * Rebase crypto-policies-FIPS.patch

OBS-URL: https://build.opensuse.org/request/show/1108344
OBS-URL: https://build.opensuse.org/package/show/security:tls/crypto-policies?expand=0&rev=21
This commit is contained in:
Pedro Monreal Gonzalez 2023-09-04 07:42:24 +00:00 committed by Git OBS Bridge
parent c840e031b3
commit f16e5f47af
9 changed files with 216 additions and 212 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

347
crypto-policies-FIPS.patch
View File

@ -1,206 +1,173 @@
Index: fedora-crypto-policies-20230420.3d08ae7/fips-mode-setup
Index: fedora-crypto-policies-20230614.5f3458e/fips-mode-setup
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/fips-mode-setup
+++ fedora-crypto-policies-20230420.3d08ae7/fips-mode-setup
@@ -7,6 +7,7 @@ enable_fips=
check=0
boot_config=1
err_if_disabled=0
+fips_install_complete=0
output_text=1
is_ostree_system=0
@@ -75,109 +76,74 @@ if test "$is_ostree_system" = 1 && test
exit 1
--- fedora-crypto-policies-20230614.5f3458e.orig/fips-mode-setup
+++ fedora-crypto-policies-20230614.5f3458e/fips-mode-setup
@@ -81,6 +81,19 @@ if [ "$(id -u)" != 0 ]; then
exit 1
fi
-
-if [ "$(id -u)" != 0 ]; then
- echo "You must be root to run $(basename $0)"
- exit 1
-fi
-
-
-# Detect 1: kernel FIPS flag
-fips_kernel_enabled=$(cat /proc/sys/crypto/fips_enabled)
-
-# Detect 2: initramfs fips module presence; not always can be done
-initramfs_fips_module=0
-initramfs_inspectable=0
-if test -d /boot -a -x /usr/bin/lsinitrd; then
- initramfs_inspectable=1
- if lsinitrd -m 2>/dev/null | grep -Fxq fips; then
- initramfs_fips_module=1
+if test "$enable_fips" = 1 ; then
+ # Check the required FIPS modules are installed
+ if test ! -x "$(command -v grubby)" -o ! -f /usr/share/doc/packages/patterns/fips.txt -o ! -f /etc/dracut.conf.d/40-fips.conf; then
+ cond_echo "Installation of FIPS modules is not complete."
+ cond_echo "Please, install grubby and the fips pattern."
+ exit 1
fi
+# This check must be done as root, otherwise it will fail.
+is_transactional_system=0
+if test ! -w /usr ; then
+ is_transactional_system=1
+fi
+
+# We don't handle the setup on transactional systems as the process is
+# quite different and involves several reboots.
+if test "$is_transactional_system" = 1 && test "$check" = 0 ; then
+ cond_echo -n "Cannot handle transactional systems. "
+ cond_echo "Please, refer to the fips-mode-setup man pages for more information."
+ exit 1
+fi
# Detect 1: kernel FIPS flag
fips_kernel_enabled=$(cat /proc/sys/crypto/fips_enabled)
@@ -203,9 +216,22 @@ else
fi
fi
-# Detect 3: crypto-policy base policy
-current_policy="$(cat /etc/crypto-policies/state/current)"
-base_policy="$(echo $current_policy| cut -f 1 -d :)"
-if test "$base_policy" == "FIPS" ; then
- base_policy_is_fips=1
-else
- base_policy_is_fips=0
+if test "$enable_fips" = 1 ; then
+ if test ! -d /boot -o ! -x /usr/bin/lsinitrd -o x"$(/usr/bin/lsinitrd -f etc/system-fips 2>/dev/null || test $? = 2 && echo y)" != x ; then
+ fips_install_complete=1
-if test "$boot_config" = 1 && test ! -x "$(command -v grubby)" ; then
- echo "The grubby command is missing, please configure the bootloader manually."
- boot_config=0
+if test "$boot_config" = 1 ; then
+ # Install required packages: patterns-base-fips and perl-Bootloader
+ if test ! -f /etc/dracut.conf.d/40-fips.conf && \
+ test ! -x "$(command -v pbl)" && \
+ test "$enable_fips" = 1; then
+ zypper -n install patterns-base-fips perl-Bootloader
+ elif test ! -f /etc/dracut.conf.d/40-fips.conf && \
+ test "$enable_fips" = 1 ; then
+ zypper -n install patterns-base-fips
+ elif test ! -x "$(command -v pbl)" ; then
+ zypper -n install perl-Bootloader
+ fi
+ if test $? != 0 ; then
+ echo "The pbl command or the fips pattern are missing, please configure the bootloader manually."
+ boot_config=0
+ fi
fi
-
if test $check = 1 ; then
- # Look for signs for both enabling and disabling FIPS mode
- fips_positive=0
- fips_negative=0
-
- # Display 1: kernel FIPS flag
- cond_echo "FIPS mode is $(enable2txt $fips_kernel_enabled)."
-
- # Display 2: initramfs fips module
- if test "$initramfs_inspectable" = 1 ; then
- cond_echo -n "Initramfs fips module is "
- cond_echo "$(enable2txt $initramfs_fips_module)."
- fi
-
- # Display 3: active crypto-policy
- cond_echo -n "The current crypto policy ($current_policy) "
- if test "$base_policy_is_fips" == 1 ; then
- cond_echo 'is based on the FIPS policy.'
- else
- cond_echo -n 'neither is the FIPS policy '
- cond_echo 'nor is based on the FIPS policy.'
- fi
-
- # Decide 1: kernel FIPS flag
- if test "$fips_kernel_enabled" = 1 ; then
- fips_positive=1
- else
- fips_negative=1
- fi
-
- # Decide 2: initramfs module presence
- if test "$initramfs_inspectable" = 1 ; then
- if test "$initramfs_fips_module" = 1 ; then
- fips_positive=1
echo "FIPS mode will be $(enable2txt $enable_fips)."
@@ -216,15 +242,19 @@ if test $boot_config = 0 ; then
echo "Now you need to configure the bootloader to add kernel options \"$fipsopts\""
echo "and reboot the system for the setting to take effect."
else
- grubby --update-kernel=ALL --args="$fipsopts"
- if test x"$(uname -m)" = xs390x; then
- if command -v zipl >/dev/null; then
- zipl
- else
- fips_negative=1
+ test $fips_install_complete = 0 && cond_echo "Installation of FIPS modules is not complete."
+ fips_enabled=$(cat /proc/sys/crypto/fips_enabled)
+ cond_echo "FIPS mode is $(enable2txt $fips_enabled)."
+ if test "$fips_enabled" = 1 ; then
+ if test $fips_install_complete = 0 ; then
+ cond_echo "Inconsistent state detected."
+ exit 1
+ fi
+ current="$(cat /etc/crypto-policies/state/current)"
+ if test "$(echo $current | cut -f 1 -d :)" != "FIPS" ; then
+ cond_echo -n "The current crypto policy ($current) "
+ cond_echo -n 'neither is the FIPS policy '
+ cond_echo 'nor is based on the FIPS policy.'
+ cond_echo 'Inconsistent state detected.'
+ exit 1
fi
- echo -n '`zipl` execution has been skipped: '
- echo '`zipl` not found.'
- fi
- fi
-
- # Decide 3: active crypto-policy
- if test "$base_policy_is_fips" = 1 ; then
- fips_positive=1
else
- fips_negative=1
- fi
-
- # Make the FIPS mode consistency decision
- if test "$fips_positive" = 1 -a "$fips_negative" = 1 ; then
- cond_echo 'Inconsistent state detected.'
- exit 1
+ if test $fips_install_complete = 1 ; then
+ cond_echo "Inconsistent state detected."
+ exit 1
+ fi
+ current="$(cat /etc/crypto-policies/state/current)"
+ if test "$(echo $current | cut -f 1 -d :)" == "FIPS" ; then
+ cond_echo -n "The current crypto policy ($current) "
+ cond_echo -n 'is based on the FIPS policy, '
+ cond_echo 'but FIPS mode is not enabled.'
+ cond_echo 'Inconsistent state detected.'
+ exit 1
+ fi
fi
-
- # Error out if `--is-enabled` was passed and FIPS mode is not enabled
- if test "$fips_positive" = 0 -a "$err_if_disabled" = 1 ; then
- cond_echo 'FIPS mode is not enabled.'
+ if test "$fips_enabled" != 1 && test "$err_if_disabled" = 1; then
exit 2
fi
-
+ pbl --add-option "$fipsopts"
+ grub2-mkconfig -o /boot/grub2/grub.cfg && dracut -f --regenerate-all
+
+ # grubby --update-kernel=ALL --args="$fipsopts"
+ # if test x"$(uname -m)" = xs390x; then
+ # if command -v zipl >/dev/null; then
+ # zipl
+ # else
+ # echo -n '`zipl` execution has been skipped: '
+ # echo '`zipl` not found.'
+ # fi
+ # fi
+
echo "Please reboot the system for the setting to take effect."
fi
Index: fedora-crypto-policies-20230614.5f3458e/fips-finish-install
===================================================================
--- fedora-crypto-policies-20230614.5f3458e.orig/fips-finish-install
+++ fedora-crypto-policies-20230614.5f3458e/fips-finish-install
@@ -23,7 +23,16 @@ fi
umask 022
-trap "rm -f $dracut_cfg" ERR
+# trap "rm -f $dracut_cfg" ERR
+
+# Install required packages: patterns-base-fips and perl-Bootloader
+if test ! -f $dracut_cfg && test ! -x "$(command -v pbl)" ; then
+ zypper -n install patterns-base-fips perl-Bootloader
+elif test ! -f $dracut_cfg ; then
+ zypper -n install patterns-base-fips
+elif test ! -x "$(command -v pbl)" ; then
+ zypper -n install perl-Bootloader
+fi
if test ! -d $dracut_cfg_d -o ! -d /boot -o "$is_ostree_system" = 1 ; then
# No dracut configuration or boot directory present, do not try to modify it.
@@ -32,23 +41,23 @@ if test ! -d $dracut_cfg_d -o ! -d /boot
exit 0
fi
+if [ "$(id -u)" != 0 ]; then
+ echo "You must be root to run $(basename $0)"
+ exit 1
+fi
if test $enable_fips = 1 ; then
- if test "$initramfs_fips_module" = 0 ; then
+ if test $fips_install_complete = 1 ; then
fips-finish-install --complete
if test $? != 0 ; then
- echo "Installation of FIPS modules could not be completed."
+ echo "Installation of FIPS modules could not be completed."
exit 1
fi
fi
- if test "$base_policy_is_fips" == 1 ; then
- cond_echo -n 'Preserving current FIPS-based policy '
- cond_echo "${current_policy}."
+ target="$(cat /etc/crypto-policies/state/current)"
+ if test "$(echo $target | cut -f 1 -d :)" == "FIPS" ; then
+ cond_echo "Preserving current FIPS-based policy ${target}."
cond_echo -n 'Please review the subpolicies to ensure they '
cond_echo 'only restrict, not relax the FIPS policy.'
else
@@ -196,11 +162,11 @@ if test x"$boot_device" = x ; then
boot_device_opt=" boot=UUID=<your-boot-device-uuid>"
boot_config=0
else
- if test "$boot_device" = / ; then
- boot_device_opt=""
- else
- boot_device_opt=" boot=UUID=$(blkid -s UUID -o value $boot_device)"
- fi
+ if test "$boot_device" = / ; then
+ boot_device_opt=""
+ else
+ boot_device_opt=" boot=UUID=$(blkid -s UUID -o value $boot_device)"
+ fi
fi
if test "$boot_config" = 1 && test ! -x "$(command -v grubby)" ; then
Index: fedora-crypto-policies-20230420.3d08ae7/fips-mode-setup.8.txt
-cat >$dracut_cfg <<EOF
-# turn on fips module
-
-add_dracutmodules+=" fips "
-EOF
-
-echo "Kernel initramdisks are being regenerated. This might take some time."
-
-dracut -f --regenerate-all
-
-# This is supposed to be a fast and safe operation that's always good to run.
-# Regenerating an initrd and skipping it might render the system unbootable
-# (RHBZ#2013195).
-if test x"$(uname -m)" = xs390x; then
- if command -v zipl >/dev/null; then
- zipl
- else
- echo '`zipl` execution has been skipped: `zipl` not found.'
- fi
-fi
+# cat >$dracut_cfg <<EOF
+# # turn on fips module
+#
+# add_dracutmodules+=" fips "
+# EOF
+#
+# echo "Kernel initramdisks are being regenerated. This might take some time."
+#
+# dracut -f --regenerate-all
+#
+# # This is supposed to be a fast and safe operation that's always good to run.
+# # Regenerating an initrd and skipping it might render the system unbootable
+# # (RHBZ#2013195).
+# if test x"$(uname -m)" = xs390x; then
+# if command -v zipl >/dev/null; then
+# zipl
+# else
+# echo '`zipl` execution has been skipped: `zipl` not found.'
+# fi
+# fi
Index: fedora-crypto-policies-20230614.5f3458e/fips-mode-setup.8.txt
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/fips-mode-setup.8.txt
+++ fedora-crypto-policies-20230420.3d08ae7/fips-mode-setup.8.txt
@@ -39,8 +39,15 @@ system crypto policy to FIPS
(unless the policy has already been set to FIPS plus subpolicies on top,
in which case the currently active subpolicies is retained).
+Some required FIPS modules (grubby, fips pattern) might not be
+installed by default. These can be installed in SUSE/openSUSE with
+the following command:
+
+ zypper in -y grubby && zypper in -y -t pattern fips
+
Then the command modifies the boot loader configuration to add
'fips=1' and 'boot=<boot-device>' options to the kernel command line.
+Note that, grubby could show a harmless warning about leaked file descriptors.
--- fedora-crypto-policies-20230614.5f3458e.orig/fips-mode-setup.8.txt
+++ fedora-crypto-policies-20230614.5f3458e/fips-mode-setup.8.txt
@@ -45,6 +45,23 @@ Then the command modifies the boot loade
When disabling the system FIPS mode the system crypto policy is switched
to DEFAULT and the kernel command line option 'fips=0' is set.
+On transactional systems, enabling the system in FIPS mode with the
+fips-mode-setup tool is not implemented. To enable the FIPS mode in these
+systems requires the following steps:
+
+ 1.- Install the FIPS pattern on a running system:
+ # transactional-update pkg install -t pattern microos-fips
+
+ 2.- Reboot your system.
+
+ 3.- Add the kernel command line parameter fips=1 to the boot loader
+ configuration. To do so, edit the file /etc/default/grub and add
+ fips=1 to the GRUB_CMDLINE_LINUX_DEFAULT variable.
+
+ 4.- After logging in to the system, run:
+ # transactional-update grub.cfg
+
+ 5.- Reboot your system.
[[options]]
OPTIONS

19
crypto-policies-policygenerators.patch
View File

@ -1,13 +1,13 @@
Index: fedora-crypto-policies-20230420.3d08ae7/python/policygenerators/__init__.py
Index: fedora-crypto-policies-20230614.5f3458e/python/policygenerators/__init__.py
===================================================================
--- fedora-crypto-policies-20230420.3d08ae7.orig/python/policygenerators/__init__.py
+++ fedora-crypto-policies-20230420.3d08ae7/python/policygenerators/__init__.py
--- fedora-crypto-policies-20230614.5f3458e.orig/python/policygenerators/__init__.py
+++ fedora-crypto-policies-20230614.5f3458e/python/policygenerators/__init__.py
@@ -8,15 +8,15 @@ from .gnutls import GnuTLSGenerator
from .java import JavaGenerator
from .java import JavaSystemGenerator
from .krb5 import KRB5Generator
-from .libreswan import LibreswanGenerator
+#from .libreswan import LibreswanGenerator
+# from .libreswan import LibreswanGenerator
from .libssh import LibsshGenerator
from .nss import NSSGenerator
from .openssh import OpenSSHClientGenerator
@ -16,17 +16,16 @@ Index: fedora-crypto-policies-20230420.3d08ae7/python/policygenerators/__init__.
from .openssl import OpenSSLGenerator
-from .sequoia import SequoiaGenerator
-from .sequoia import RPMSequoiaGenerator
+#from .sequoia import SequoiaGenerator
+#from .sequoia import RPMSequoiaGenerator
+# from .sequoia import SequoiaGenerator
+# from .sequoia import RPMSequoiaGenerator
__all__ = [
'BindGenerator',
@@ -24,13 +24,13 @@ __all__ = [
@@ -24,13 +24,14 @@ __all__ = [
'JavaGenerator',
'JavaSystemGenerator',
'KRB5Generator',
- 'LibreswanGenerator',
+# 'LibreswanGenerator',
'LibsshGenerator',
'NSSGenerator',
'OpenSSHClientGenerator',
@ -35,6 +34,8 @@ Index: fedora-crypto-policies-20230420.3d08ae7/python/policygenerators/__init__.
'OpenSSLGenerator',
- 'SequoiaGenerator',
- 'RPMSequoiaGenerator',
]
+
+# 'LibreswanGenerator',
+# 'SequoiaGenerator',
+# 'RPMSequoiaGenerator',
]

15
crypto-policies-pylint.patch Normal file
View File

@ -0,0 +1,15 @@
Index: fedora-crypto-policies-20230614.5f3458e/Makefile
===================================================================
--- fedora-crypto-policies-20230614.5f3458e.orig/Makefile
+++ fedora-crypto-policies-20230614.5f3458e/Makefile
@@ -44,8 +44,8 @@ runflake8:
@find -name '*.py' | grep -v krb5check | xargs flake8 --config .flake8
runpylint:
- PYTHONPATH=. pylint$(PYVERSION) --rcfile=pylintrc python
- PYTHONPATH=. pylint$(PYVERSION) --rcfile=pylintrc tests
+ PYTHONPATH=. pylint --rcfile=pylintrc python
+ PYTHONPATH=. pylint --rcfile=pylintrc tests
@echo "[ OK ]"
runcodespell:

2
crypto-policies.7.gz
View File

@ -1,3 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:5eceb5b5a5360d08e1f85163bea95bdb84c748e1e3836765b400773d42bba1c9
oid sha256:6071a2f41678232b63d27d3f1bbd73915f85159fda78f71ae8a63d8bdce388e0
size 6937

16
crypto-policies.changes
View File

@ -1,3 +1,19 @@
-------------------------------------------------------------------
Thu Aug 31 12:17:44 UTC 2023 - Pedro Monreal <pmonreal@suse.com>
- Tests: Fix pylint versioning for TW and fix the parsing of the
policygenerators to account for the commented lines correctly.
* Add crypto-policies-pylint.patch
* Rebase crypto-policies-policygenerators.patch
-------------------------------------------------------------------
Tue Aug 1 12:23:33 UTC 2023 - Pedro Monreal <pmonreal@suse.com>
- FIPS: Adapt the fips-mode-setup script to use the pbl command
from the perl-Bootloader package to replace grubby. Add a note
for transactional systems [jsc#PED-4578].
* Rebase crypto-policies-FIPS.patch
-------------------------------------------------------------------
Fri Jul 14 14:59:06 UTC 2023 - Marcus Meissner <meissner@suse.com>

21
crypto-policies.spec
View File

@ -51,8 +51,10 @@ Patch2: crypto-policies-policygenerators.patch
Patch3: crypto-policies-supported.patch
#PATCH-FIX-OPENSUSE Revert a breaking change that introduces rh-allow-sha1-signatures
Patch4: crypto-policies-revert-rh-allow-sha1-signatures.patch
#PATCH-FIX-OPENSUSE Adpat the fips-mode-setup script for TW
Patch5: crypto-policies-FIPS.patch
#PATCH-FIX-OPENSUSE Remove version for pylint from Makefile
Patch5: crypto-policies-pylint.patch
#PATCH-FIX-OPENSUSE Adpat the fips-mode-setup script for SUSE/openSUSE [jsc#PED-4578]
Patch6: crypto-policies-FIPS.patch
BuildRequires: python3-base >= 3.6
# The sequoia stuff needs python3-toml, removed until needed
# BuildRequires: python3-toml
@ -62,10 +64,12 @@ BuildRequires: asciidoc
%if %{with testsuite}
# The following packages are needed for the testsuite
BuildRequires: bind
BuildRequires: codespell
BuildRequires: gnutls >= 3.6.0
BuildRequires: java-devel
BuildRequires: krb5-devel
BuildRequires: libxslt
#BuildRequires: mozilla-nss-tools
BuildRequires: openssl
BuildRequires: perl
BuildRequires: python3-coverage
@ -79,9 +83,9 @@ BuildRequires: perl(File::Which)
BuildRequires: perl(File::pushd)
%endif
Recommends: crypto-policies-scripts
Conflicts: gnutls < 3.7.0
Conflicts: gnutls < 3.7.3
#Conflicts: libreswan < 3.28
Conflicts: nss < 3.44.0
Conflicts: nss < 3.90.0
#Conflicts: openssh < 8.2p1
#!BuildIgnore: crypto-policies
BuildArch: noarch
@ -94,7 +98,7 @@ such as SSL/TLS libraries.
%package scripts
Summary: Tool to switch between crypto policies
Requires: %{name} = %{version}-%{release}
Recommends: grubby
Recommends: perl-Bootloader
%description scripts
This package provides a tool update-crypto-policies, which applies
@ -141,11 +145,11 @@ install -p -m 644 default-config %{buildroot}%{_sysconfdir}/crypto-policies/conf
touch %{buildroot}%{_sysconfdir}/crypto-policies/state/current
touch %{buildroot}%{_sysconfdir}/crypto-policies/state/CURRENT.pol
%if %{without manbuild}
# Install the manpages from defined sources
mkdir -p -m 755 %{buildroot}%{_mandir}/
mkdir -p -m 755 %{buildroot}%{_mandir}/man7/
mkdir -p -m 755 %{buildroot}%{_mandir}/man8/
%if %{without manbuild}
# Install the manpages from defined sources
cp %{SOURCE2} %{buildroot}%{_mandir}/man7/
cp %{SOURCE3} %{SOURCE4} %{SOURCE5} %{buildroot}%{_mandir}/man8/
%endif
@ -181,7 +185,8 @@ install -p -m 644 %{SOURCE1} %{buildroot}%{_sysconfdir}/crypto-policies
%check
%if %{with testsuite}
export OPENSSL_CONF=''
%make_build test test-install test-fips-setup || :
%make_build test
%make_build test-install test-fips-setup || :
%endif
%post -p <lua>

2
fips-finish-install.8.gz
View File

@ -1,3 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:b0c4844eb573ddb5517d78c0e2e663066413ef3807dfa63df5ee43c0fefe1582
oid sha256:3036b9fde1e86342746075d825d23eab12ee54228ebae9b6746e93bd51e3ada8
size 825

4
fips-mode-setup.8.gz
View File

@ -1,3 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:af453be70b0971f4e4139eec3b669bee3b5195df2d7c28853d3fd4c4006cbb1b
size 1542
oid sha256:b29d2ba880077b33ef73932ca13ef88581e66288c4277a610aff9afa3a354b59
size 1648

2
update-crypto-policies.8.gz
View File

@ -1,3 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:cad2a9da340059b6ba7b84c9646a85f113cb8781d55c0ea5c8aa0422ea632c3c
oid sha256:950fcd3d9729c215baaa0dddb9434b01f02addca6aa4a4404a8d2ad65ef53598
size 4154