ComplianceAsCode / ComplianceAsCode/content
`enable_fips_mode` and `enable_dracut_fips_module` fail in Image Builder
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
When using Image Builder, FIPS remediation is done via Blueprint, by `oscap` generating a
```toml
[customizations]
fips=1
```
section, which instructs OSBuild to install the system with FIPS enabled.
This is correctly represented in content Bash remediations, which are skipped:
```
Remediating rule 1/144: 'xccdf_org.ssgproject.content_rule_enable_dracut_fips_module'
Remediation is not applicable, nothing was done
Remediating rule 2/144: 'xccdf_org.ssgproject.content_rule_enable_fips_mode'
Remediation is not applicable, nothing was done
```
However scanning the booted image with `oscap` makes the rules fail.
Checking out the HTML report, `enable_dracut_fips_module` is failing because it didn't find a pattern in `/etc/dracut.conf.d/40-fips.conf`, and that file does not even exist on the image:
```
[root@localhost ~]# cat /etc/dracut.conf
# PUT YOUR CONFIG IN separate files
# in /etc/dracut.conf.d named ".conf"
# SEE man dracut.conf(5) for options
[root@localhost ~]# find /etc/dracut.conf.d/
/etc/dracut.conf.d/
```
and the `.d` directory is also empty.
Despite that, FIPS seems enabled:
```
[root@localhost ~]# fips-mode-setup --check
FIPS mode is enabled.
```
so maybe the dracut rule should be `notapplicable`? .. Or maybe this is an OSBuild bug because dracut should have the fips module added for some extra security?
The `enable_fips_mode` rule failed on seemingly several things, incl. `fips=1` missing on the kernel cmdline, so that's presumably an OSBuild bug .. ?
See the gzipped HTML report for more:
* [report.html.gz](https://github.com/ComplianceAsCode/content/files/14216214/report.html.gz)
More investigation might be needed - ie. compiling a list of all the steps the content checks for, vs what OSBuild does.
#### SCAP Security Guide Version:
master @ 17ea37391378eb5304c465b893b5ecb079f1e70c
#### Operating System Version:
RHEL-9, and probably RHEL-8 too, but can't check due to image building errors
Contributor guide
Assessment
This issue has not been assessed yet.