ComplianceAsCode / ComplianceAsCode/content

`enable_fips_mode` and `enable_dracut_fips_module` fail in Image Builder

Open
#11,567 0 comments 2 reactions 0 assignees View on GitHub
osbuild triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:
When using Image Builder, FIPS remediation is done via Blueprint, by `oscap` generating a
```toml
[customizations]
fips=1
```
section, which instructs OSBuild to install the system with FIPS enabled.

This is correctly represented in content Bash remediations, which are skipped:
```
Remediating rule 1/144: 'xccdf_org.ssgproject.content_rule_enable_dracut_fips_module'
Remediation is not applicable, nothing was done
Remediating rule 2/144: 'xccdf_org.ssgproject.content_rule_enable_fips_mode'
Remediation is not applicable, nothing was done
```

However scanning the booted image with `oscap` makes the rules fail.

Checking out the HTML report, `enable_dracut_fips_module` is failing because it didn't find a pattern in `/etc/dracut.conf.d/40-fips.conf`, and that file does not even exist on the image:
```
[root@localhost ~]# cat /etc/dracut.conf
# PUT YOUR CONFIG IN separate files
# in /etc/dracut.conf.d named ".conf"
# SEE man dracut.conf(5) for options

[root@localhost ~]# find /etc/dracut.conf.d/
/etc/dracut.conf.d/
```
and the `.d` directory is also empty.

Despite that, FIPS seems enabled:
```
[root@localhost ~]# fips-mode-setup --check
FIPS mode is enabled.
```
so maybe the dracut rule should be `notapplicable`? .. Or maybe this is an OSBuild bug because dracut should have the fips module added for some extra security?

The `enable_fips_mode` rule failed on seemingly several things, incl. `fips=1` missing on the kernel cmdline, so that's presumably an OSBuild bug .. ?

See the gzipped HTML report for more:
* [report.html.gz](https://github.com/ComplianceAsCode/content/files/14216214/report.html.gz)

More investigation might be needed - ie. compiling a list of all the steps the content checks for, vs what OSBuild does.

#### SCAP Security Guide Version:
master @ 17ea37391378eb5304c465b893b5ecb079f1e70c

#### Operating System Version:
RHEL-9, and probably RHEL-8 too, but can't check due to image building errors

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.