Skip to content

Conversation

@jan-cerny
Copy link
Collaborator

This commit will remove remaining references in extend_definition to rule installed_OS_is_FIPS_certified. This is a follow up on the removal that has been done in
#13594.

Affected rules are failing
because of installed_OS_is_FIPS_certified was evaluated as false. The problem is that the rule installed_OS_is_FIPS_certified doesn't make sense because OS can't be ceritified by FIPS, instead specific cryptography modules are FIPS certified. The modules need to be of a specific version of the cryptography library, so the check shouldn't be tied to a OS major version For information about FIPS certified cryptography modules in Red Hat products, see: https://access.redhat.com/compliance/fips

For checking FIPS compliance status we have a different rule enable_fips_mode, if this rule is included in the profile we don't need to inject any checks to other rules.

Another factor is that the rule installed_OS_is_FIPS_certified fails on RHEL 9 and 10 because the list hasn't been updated which means the dependent rules always failed on these systems.

This change affects rules:

  • grub2_enable_fips_mode
  • package_dracut-fips-aesni_installed
  • package_dracut-fips_installed
  • aide_use_fips_hashes

Resolves: https://issues.redhat.com/browse/RHEL-81743

This commit will remove remaining references in extend_definition to
rule installed_OS_is_FIPS_certified.  This is a follow up on the removal
that has been done in
ComplianceAsCode#13594.

Affected rules are failing
because of installed_OS_is_FIPS_certified was evaluated as false.
The problem is that the rule installed_OS_is_FIPS_certified doesn't
make sense because OS can't be ceritified by FIPS, instead specific
cryptography modules are FIPS certified. The modules need to be of a
specific version of the cryptography library, so the check shouldn't
be tied to a OS major version For information about FIPS
certified cryptography modules in Red Hat products, see:
https://access.redhat.com/compliance/fips

For checking FIPS compliance status we have a different rule enable_fips_mode,
if this rule is included in the profile we don't need to inject
any checks to other rules.

Another factor is that the rule installed_OS_is_FIPS_certified
fails on RHEL 9 and 10 because the list hasn't been updated which means
the dependent rules always failed on these systems.

This change affects rules:
- grub2_enable_fips_mode
- package_dracut-fips-aesni_installed
- package_dracut-fips_installed
- aide_use_fips_hashes

Resolves: https://issues.redhat.com/browse/RHEL-81743
@jan-cerny jan-cerny added this to the 0.1.78 milestone Aug 1, 2025
@jan-cerny jan-cerny added the bugfix Fixes to reported bugs. label Aug 1, 2025
@Mab879 Mab879 self-assigned this Aug 4, 2025
@Mab879 Mab879 merged commit 65c1adc into ComplianceAsCode:master Aug 4, 2025
128 of 130 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Fixes to reported bugs.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants