WSL Kernel FIPS mode
- Dominant language
- C++
- Stars
- 33.7k
- Forks
- 1.8k
- Avg merge
- 3d 17h
- Merged PRs (30d)
- 116
Description
**Is your feature request related to a problem? Please describe.**
The WSL kernel appears to be designed to prevent FIPS 140-2 enforcement.
**Describe the solution you'd like**
The ability to turn on FIPS mode in the kernel using "fips=1" as with a standard Linux kernel.
**Describe alternatives you've considered**
Merely including openssl-fips or other packages isn't enough to satisfy testing protocols. We work in software development for government systems and the ability to test our code on systems that will be like those we deploy on is a must. Without fips mode enabled on the kernel, WSL distros are unable to be setup like a deployment STIG'd environment for testing.
**Additional context**
Federal Information Processing Standard (FIPS) 140-2 requires the use of certain validated algorithms for encryption and hashing. The standard Linux kernel enables enforcement of these algorithms through the "fips" kernel directive as long as CONFIG_CRYPTO_FIPS has been set to "y" during compilation. The WSL kernel does not include the fips directive and does not allow for CONFIG_CRYPTO_FIPS to be enabled during kernel compilation. We recently discovered a situation where our code ran fine on WSL, but was failing on a STIG'd Linux machine that we traced to FIPS enforcement.
Contributor guide
Research direction
Start by reviewing the WSL kernel configuration and boot handling for the mentioned fips=1 directive and CONFIG_CRYPTO_FIPS setting. Done means WSL can enable kernel FIPS enforcement in a way that supports STIG-like testing, with validation against the stated FIPS requirements.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100