Adjust FIPS enable_fips_mode for RHEL 10 #12414
Conversation
Also allow the source of truth /proc/sys/crypto/fips_enabled to pass this file check.
No longer used on RHEL10.
|
Start a new ephemeral environment with changes proposed in this pull request: rhel8 (from CTF) Environment (using Fedora as testing environment) Fedora Testing Environment Oracle Linux 8 Environment |
|
This datastream diff is auto generated by the check Click here to see the full diffOVAL for rule 'xccdf_org.ssgproject.content_rule_enable_fips_mode' differs.
--- oval:ssg-enable_fips_mode:def:1
+++ oval:ssg-enable_fips_mode:def:1
@@ -1,5 +1,5 @@
criteria AND
-extend_definition oval:ssg-etc_system_fips_exists:def:1
+criterion oval:ssg-test_proc_sys_crypto_fips_enabled:tst:1
extend_definition oval:ssg-sysctl_crypto_fips_enabled:def:1
extend_definition oval:ssg-enable_dracut_fips_module:def:1
extend_definition oval:ssg-configure_crypto_policy:def:1 |
|
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
| <extend_definition definition_ref="etc_system_fips_exists" | ||
| comment="check /etc/system-fips file existence"/> | ||
| <criterion test_ref="test_proc_sys_crypto_fips_enabled" | ||
| comment="check contents of /proc/sys/crypto/fips_enabled"/> |
There was a problem hiding this comment.
Should the check for /proc/sys be used on all systems? Isn't it only for RHEL 10? And should the /etc/system-fips be checked on RHEL 10 if it's deprecated?
There was a problem hiding this comment.
The /proc/sys/crypto/fips_enabled does exist on RHEL 7. I will just use it everywhere.
|
Code Climate has analyzed commit 4be6192 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.5% (0.0% change). View more on Code Climate. |
Description:
Adjust FIPS enable_fips_mode for RHEL 10
Rationale:
Fixes #12405