Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Updated bash remediation for the rule grub2_enable_fips_mode #4291

Closed
wants to merge 1 commit into from
Closed

Updated bash remediation for the rule grub2_enable_fips_mode #4291

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion linux_os/guide/system/software/integrity/fips/grub2_enable_fips_mode/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,11 @@ disable_prelink

package_install dracut-fips

# Enable AESNI if supported
if grep -q -m1 -o aes /proc/cpuinfo; then
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Preferentially, this would be in an OVAL file and added to the OVAL grub FIPS check using the OVAL and bash templates.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a preferred configuration, but not a security requirement. I would think that the OVAL should only check that the security requirement is met.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OVAL is more than about meeting security requirements. Please add an extended_definition check to the grub2_enabled_fips OVAL for AES as there is a configuration change here. So, there needs to be:

  1. An extended_definition check added to grub2_enable_fips_mode OVAL
  2. A dracut-fips-aesni OVAL check in shared/checks that checks for AESNI enabled processors and that the dracut-fips-aesni package is installed.
  3. The dracut-fips-aesni package needs to be added to the correct OS templates.

package_install dracut-fips-aesni
fi

dracut -f

# Correct the form of default kernel command line in grub
Expand All @@ -26,8 +31,13 @@ if grep -q '^GRUB_CMDLINE_LINUX=".*boot=.*"' /etc/default/grub; then
sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)boot=[^[:space:]]*\(.*"\)/\1 boot=UUID='"${BOOT_UUID} \2/" /etc/default/ grub
else
# no existing boot=arg is present, append it
sed -i 's/\(^GRUB_CMDLINE_LINUX=".*\)"/\1 boot=UUID='${BOOT_UUID}'"/' /etc/default/grub
sed -i "s/\(^GRUB_CMDLINE_LINUX=\".*\)\"/\1 boot=UUID=${BOOT_UUID}\"/" /etc/default/grub
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This line could be the fix for #3136!

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I tested this line that currently exists in the code, and it did seem to work properly even if it was imperfect.

Your referenced issue looks like it was fixed with this commit:
2a044d5

Anyone with that issue was most likely using an older version that did not contain that change.

fi

# Correct the form of kernel command line for each installed kernel in the bootloader
/sbin/grubby --update-kernel=ALL --args="fips=1 boot=UUID=${BOOT_UUID}"

# Disable ed25519 key in SSH configuration (does not work in FIPS mode)
if grep -q '^HostKey /etc/ssh/ssh_host_ed25519_key' /etc/ssh/sshd_config; then
sed -i 's|^HostKey /etc/ssh/ssh_host_ed25519_key|#HostKey /etc/ssh/ssh_host_ed25519_key|' /etc/ssh/sshd_config
fi
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmmmm..... not sure that this makes sense to be in the FIPS grub rememdiation.....

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure where else you would put this. The need for this change is directly tied to enabling FIPS mode.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a separate rule with separate OVAL and remediations then as the SSH HostKey's now need to be verified against FIPS.