diff --git a/libgcrypt-fips_ignore_FIPS_MODULE_PATH.patch b/libgcrypt-1.8.4-fips_ctor_skip_integrity_check.patch similarity index 53% rename from libgcrypt-fips_ignore_FIPS_MODULE_PATH.patch rename to libgcrypt-1.8.4-fips_ctor_skip_integrity_check.patch index 62bd6b5..36044e4 100644 --- a/libgcrypt-fips_ignore_FIPS_MODULE_PATH.patch +++ b/libgcrypt-1.8.4-fips_ctor_skip_integrity_check.patch @@ -1,28 +1,32 @@ Index: libgcrypt-1.8.4/src/global.c =================================================================== ---- libgcrypt-1.8.4.orig/src/global.c 2019-03-25 16:58:45.880313488 +0100 -+++ libgcrypt-1.8.4/src/global.c 2019-03-25 16:58:45.896313582 +0100 -@@ -144,11 +144,6 @@ global_init (void) - BUG (); +--- libgcrypt-1.8.4.orig/src/global.c ++++ libgcrypt-1.8.4/src/global.c +@@ -141,27 +141,10 @@ global_init (void) } -- + -#ifndef FIPS_MODULE_PATH -#define FIPS_MODULE_PATH "/etc/system-fips" -#endif - void __attribute__ ((constructor)) _gcry_global_constructor (void) { - int rv; -@@ -156,11 +151,6 @@ void __attribute__ ((constructor)) _gcry +- int rv; +- /* We always need the FSM lock to be functional. */ _gcry_initialize_fsm_lock (); - +- - rv = access (FIPS_MODULE_PATH, F_OK); - if (rv < 0 && errno != ENOENT) - rv = 0; - - if (!rv) - { - /* We run the integrity check at this point. The remaining - selftests are run before use of the library by application. */ +- { +- /* We run the integrity check at this point. The remaining +- selftests are run before use of the library by application. */ +- _gcry_fips_run_selftests (0); +- } + } + + /* This function is called by the macro fips_is_operational and makes diff --git a/libgcrypt-fips_run_selftest_at_constructor.patch b/libgcrypt-fips_run_selftest_at_constructor.patch deleted file mode 100644 index ed22926..0000000 --- a/libgcrypt-fips_run_selftest_at_constructor.patch +++ /dev/null @@ -1,17 +0,0 @@ -Index: libgcrypt-1.6.1/src/global.c -=================================================================== ---- libgcrypt-1.6.1.orig/src/global.c 2014-09-21 11:41:09.242948783 +0200 -+++ libgcrypt-1.6.1/src/global.c 2014-09-21 11:54:49.567586644 +0200 -@@ -124,7 +124,11 @@ global_init (void) - err = _gcry_mpi_init (); - if (err) - goto fail; -- -+ if (fips_mode()) { -+ err = _gcry_fips_run_selftests (0); -+ if (err) -+ goto fail; -+ } - return; - - fail: diff --git a/libgcrypt.changes b/libgcrypt.changes index 3a73fb8..c80fb1e 100644 --- a/libgcrypt.changes +++ b/libgcrypt.changes @@ -1,3 +1,14 @@ +------------------------------------------------------------------- +Wed Jun 26 06:52:54 UTC 2019 - Jason Sikes + +- Fixed redundant fips tests in some situations causing sudo to stop + working when pam-kwallet is installed. bsc#1133808 + * Added libgcrypt-1.8.4-fips_ctor_skip_integrity_check.patch + * Removed libgcrypt-fips_run_selftest_at_constructor.patch + because it was obsoleted by libgcrypt-1.8.3-fips-ctor.patch + * Removed libgcrypt-fips_ignore_FIPS_MODULE_PATH.patch + because it was obsoleted by libgcrypt-1.8.4-fips_ctor_skip_integrity_check.patch + ------------------------------------------------------------------- Fri Jun 21 16:53:07 UTC 2019 - Pedro Monreal Gonzalez diff --git a/libgcrypt.spec b/libgcrypt.spec index c5ea08f..ac9d1b1 100644 --- a/libgcrypt.spec +++ b/libgcrypt.spec @@ -50,14 +50,11 @@ Patch14: libgcrypt-1.6.1-fips-cfgrandom.patch Patch28: libgcrypt-fix-rng.patch #PATCH-FIX-SUSE add FIPS CAVS test app for DRBG Patch30: drbg_test.patch -#PATCH-FIX-SUSE run FIPS self-test from constructor -Patch32: libgcrypt-fips_run_selftest_at_constructor.patch #PATCH-FIX-UPSTREAM bsc#1064455 fipsdrv patch to enable --algo for dsa-sign Patch35: libgcrypt-fipsdrv-enable-algo-for-dsa-sign.patch #PATCH-FIX-UPSTREAM bsc#1064455 fipsdrv patch to enable --algo for dsa-verify Patch36: libgcrypt-fipsdrv-enable-algo-for-dsa-verify.patch Patch39: libgcrypt-1.8.3-fips-ctor.patch -Patch40: libgcrypt-fips_ignore_FIPS_MODULE_PATH.patch Patch41: libgcrypt-binary_integrity_in_non-FIPS.patch Patch42: libgcrypt-fips_rsa_no_enforced_mode.patch Patch43: libgcrypt-1.8.4-use_xfree.patch @@ -68,6 +65,7 @@ Patch45: libgcrypt-1.8.4-getrandom.patch Patch46: libgcrypt-CVE-2019-12904-GCM-Prefetch.patch Patch47: libgcrypt-CVE-2019-12904-GCM.patch Patch48: libgcrypt-CVE-2019-12904-AES.patch +Patch49: libgcrypt-1.8.4-fips_ctor_skip_integrity_check.patch BuildRequires: automake >= 1.14 BuildRequires: fipscheck BuildRequires: libgpg-error-devel >= 1.25