DISA STIG RHEL-07: modprobe: FATAL: Module sha1 not found and FIPS integrity test failed

[ykorkmaz]

Description of problem:

After the CENTOS 7 installation on a physical server where DISA STIG profile is selected, I got the following error message and can not boot into OS: "dracut-pre-trigger[646]: modprobe: FATAL: Module sha1 not found" and "FIPS integrity test failed".
Actually, I repeated the installation already a couple of times and got the same error message and think it is because of the security profile selected which is DISA STIG RHEL7.

SCAP Security Guide Version:

Built-in CentOS

Operating System Version:

CentOS 7

Steps to Reproduce:

1. Start OS installation on a server with UEFI boot
2. Select DISA STIG RHEL7 profile
3. Reboot the server

Actual Results:

FIPS verification failed

Expected Results:

FIPS verification successful

Addition Information/Debugging Steps:

[ykorkmaz]

It turned out that UUID of the boot partition was not specified in the in the GRUB_CMDLINE_LINUX key in /etc/default/grub file. After adding it manually and rebuilding the grub.conf, the problem has been resolved.

However, I have selected the DISA STIG RHEL7 profile during installation and UUID should have been already added to the boot loader configuration to enable FIPS as described in the following documentation: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-federal_standards_and_regulations

Somehow the selected profile only adds the fips=1 parameter but not UUID of the boot partition which causes the problem after an update or so.

[matejak]

For reference, we have a related BZ issue:

https://bugzilla.redhat.com/show_bug.cgi?id=1672737

The remediation seems to add the UUID, check out linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode/bash/shared.sh, could @ykorkmaz please recheck whether it is still valid?

[Mab879]

Thanks for opening this issue.

RHEL 7 has been removed from the project. See #12093 for more details.

I'm closing this issue since RHEL7 has been removed from the project and there are signs that issue might already be fixed.