Skip to content

Commit 3da3481

Browse files
The-MuleThe-Mule
committed
prepare: add FIPS feature (RHEL and CentOS only)
Signed-off-by: Ondrej Moris <[email protected]>
1 parent 880c133 commit 3da3481

File tree

2 files changed

+204
-0
lines changed

2 files changed

+204
-0
lines changed

‎tmt/steps/prepare/feature.py

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
import tmt.steps
99
import tmt.steps.prepare
1010
import tmt.steps.provision
11+
import tmt.steps.provision.podman
1112
import tmt.utils
1213
from tmt.result import PhaseResult
1314
from tmt.steps.provision import Guest
@@ -79,6 +80,16 @@ def disable(self) -> None:
7980
}
8081

8182

83+
class FIPS(ToggleableFeature):
84+
NAME = 'fips'
85+
86+
def enable(self) -> None:
87+
self._enable('fips-enable.yaml')
88+
89+
def disable(self) -> None:
90+
self.warn(f"Unsupported feature '{self.NAME.upper()}'.")
91+
92+
8293
@dataclasses.dataclass
8394
class PrepareFeatureData(tmt.steps.prepare.PrepareStepData):
8495
epel: Optional[str] = field(

‎tmt/steps/prepare/feature/fips-enable.yaml

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
- name: Enable FIPS mode on RHEL-7, RHEL-8, RHEL-9 and RHEL-10
2+
hosts: all
3+
4+
tasks:
5+
- name: Fail on distribution other than RHEL or CentOS
6+
ansible.builtin.fail:
7+
msg: "We support FIPS mode on RHEL or CentOS, only!"
8+
when:
9+
- ansible_facts['distribution'] != 'RedHat'
10+
- ansible_facts['distribution'] != 'CentOS'
11+
12+
- name: Check if SUT is a container
13+
ansible.builtin.command: cat /proc/1/environ
14+
register: proc_1_environ
15+
changed_when: false
16+
17+
- name: Register cpuinfo
18+
ansible.builtin.command: cat /proc/cpuinfo
19+
register: cpuinfo_contents
20+
changed_when: false
21+
22+
- name: Enforce modulus bits for OpenSSL
23+
ansible.builtin.shell: |
24+
changed=0
25+
if ! grep 'OPENSSL_ENFORCE_MODULUS_BITS' /etc/environment; then
26+
echo 'OPENSSL_ENFORCE_MODULUS_BITS=true' >> /etc/environment
27+
changed=1
28+
fi
29+
if [ -f /etc/profile.d/openssl.sh ] || \
30+
! grep 'export OPENSSL_ENFORCE_MODULUS_BITS=true' /etc/profile.d/openssl.sh; then
31+
echo 'export OPENSSL_ENFORCE_MODULUS_BITS=true' > /etc/profile.d/openssl.sh
32+
chmod +x /etc/profile.d/openssl.sh
33+
changed=1
34+
fi
35+
if [ -f /etc/profile.d/openssl.csh ] || \
36+
! grep 'setenv OPENSSL_ENFORCE_MODULUS_BITS true' /etc/profile.d/openssl.csh; then
37+
echo 'setenv OPENSSL_ENFORCE_MODULUS_BITS true' > /etc/profile.d/openssl.csh
38+
chmod +x /etc/profile.d/openssl.csh
39+
changed=1
40+
fi
41+
test "$changed" -eq 1
42+
register: output
43+
changed_when: output.rc == 0
44+
45+
- name: Disable prelink
46+
ansible.builtin.shell: |
47+
if rpm -q prelink; then
48+
if pgrep prelink; then
49+
killall prelink && echo "CHANGED"
50+
fi
51+
if ! grep "PRELINKING=no" /etc/sysconfig/prelink; then
52+
sed -i 's/PRELINKING=.*/PRELINKING=no/g' /etc/sysconfig/prelink
53+
prelink -u -a
54+
killall prelink
55+
echo "CHANGED"
56+
fi
57+
fi
58+
register: output
59+
changed_when: '"CHANGED" in output.stdout'
60+
when: ansible_facts['distribution_major_version'] | int == 7
61+
62+
- name: Install crypto-policies-scripts and dracut-fips
63+
ansible.builtin.dnf:
64+
name:
65+
- crypto-policies-scripts
66+
- dracut-fips
67+
state: present
68+
when: ansible_facts['distribution_major_version'] | int > 7
69+
70+
# skip_ansible_lint is present int the following two tasks to prevent
71+
# lint warning suggesting to use dnf module for yum commands, we cannot
72+
# do that because yum backend in dnf module is only available until
73+
# ansible-core 2.17
74+
- name: Install dracut-fips
75+
ansible.builtin.command: yum install -y dracut-fips
76+
register: output
77+
changed_when: output.rc == 0
78+
when: ansible_facts['distribution_major_version'] | int == 7
79+
tags: skip_ansible_lint
80+
81+
- name: Install grubby, dracut modules and modify bootloader (irrelevant for a container)
82+
when: "'container' not in proc_1_environ.stdout"
83+
block:
84+
85+
- name: Install grubby
86+
ansible.builtin.dnf:
87+
name: grubby
88+
state: present
89+
when: ansible_facts['distribution_major_version'] | int > 7
90+
91+
# skip_ansible_lint is present int the following two tasks to prevent
92+
# lint warning suggesting to use dnf module for yum commands, we cannot
93+
# do that because yum backend in dnf module is only available until
94+
# ansible-core 2.17
95+
- name: Install grubby
96+
ansible.builtin.command: yum install -y grubby
97+
register: output
98+
changed_when: output.rc == 0
99+
when: ansible_facts['distribution_major_version'] | int == 7
100+
tags: skip_ansible_lint
101+
102+
- name: Install dracut-fips-aesni
103+
ansible.builtin.command: yum install -y dracut-fips-aesni
104+
register: output
105+
changed_when: output.rc == 0
106+
when: cpuinfo_contents.stdout.find('<aes>') == 1 and cpuinfo_contenxt.stdout.find('<GenuineIntel>') and
107+
ansible_facts['distribution_major_version'] | int == 7
108+
tags: skip_ansible_lint
109+
110+
- name: Modify bootloader settings
111+
ansible.builtin.shell: |
112+
boot_device="$(stat -c %d:%m /boot)"
113+
root_device="$(stat -c %d:%m /)"
114+
boot_device_opt=""
115+
if [ "$boot_device" != "$root_device" ]; then
116+
# Trigger autofs if boot is mounted by automount.boot.
117+
pushd /boot >/dev/null 2>&1 && popd
118+
FINDMNT_UUID="findmnt --first-only -t noautofs --noheadings --output uuid"
119+
boot_uuid=$(
120+
$FINDMNT_UUID --mountpoint /boot --fstab ||
121+
$FINDMNT_UUID /boot --fstab ||
122+
$FINDMNT_UUID --mountpoint /boot ||
123+
$FINDMNT_UUID /boot
124+
)
125+
boot_device_opt=" boot=UUID=$boot_uuid"
126+
fi
127+
grubby --update-kernel=ALL --args="fips=1 $boot_device_opt"
128+
register: output
129+
changed_when: output.rc == 0
130+
when: ansible_facts['distribution_major_version'] not in "8 9"
131+
132+
- name: Regenerate initramfs
133+
ansible.builtin.command: dracut -v -f --regenerate-all
134+
register: output
135+
changed_when: output.rc == 0
136+
when: ansible_facts['distribution_major_version'] | int == 7
137+
138+
- name: Execute zipl
139+
ansible.builtin.command: zipl
140+
register: output
141+
changed_when: output.rc == 0
142+
when: ansible_facts['architecture'] == "s390x" and ansible_facts['distribution_major_version'] not in ["8", "9"]
143+
144+
- name: Enable FIPS policy
145+
ansible.builtin.command: update-crypto-policies --set FIPS
146+
register: output
147+
changed_when: output.rc == 0
148+
when: ansible_facts['distribution_major_version'] | int >= 10
149+
150+
- name: Enable FIPS mode
151+
ansible.builtin.command: fips-mode-setup --enable
152+
environment:
153+
FIPS_MODE_SETUP_SKIP_WARNING: "1"
154+
register: output
155+
changed_when: output.rc == 0
156+
when:
157+
- ansible_facts['distribution_major_version'] in ["8", "9"]
158+
- "'container' not in proc_1_environ.stdout"
159+
160+
- name: Enable FIPS mode (container version)
161+
ansible.builtin.command: fips-mode-setup --enable --no-bootcfg
162+
environment:
163+
FIPS_MODE_SETUP_SKIP_WARNING: "1"
164+
register: output
165+
changed_when: output.rc == 0
166+
when:
167+
- ansible_facts['distribution_major_version'] in ["8", "9"]
168+
- "'container' in proc_1_environ.stdout"
169+
170+
- name: Reboot
171+
ansible.builtin.reboot:
172+
when: "'container' not in proc_1_environ.stdout"
173+
174+
- name: Kernel is running in FIPS mode
175+
ansible.builtin.command: grep 1 /proc/sys/crypto/fips_enabled
176+
changed_when: false
177+
178+
- name: Userspace is running in FIPS mode
179+
ansible.builtin.command: test -e /etc/system-fips
180+
changed_when: false
181+
when: ansible_facts['distribution_major_version'] | int < 10
182+
183+
- name: Tool fips-mode-setup reports FIPS mode
184+
ansible.builtin.command: fips-mode-setup --is-enabled
185+
changed_when: false
186+
when:
187+
- ansible_facts['distribution_major_version'] in ["8", "9"]
188+
- "'container' not in proc_1_environ.stdout"
189+
190+
- name: Check that FIPS policy is enabled
191+
ansible.builtin.command: grep FIPS /etc/crypto-policies/state/current
192+
changed_when: false
193+
when: ansible_facts['distribution_major_version'] | int >= 8

0 commit comments

Comments
 (0)