Skip to content

Commit a9802f7

Browse files
Mab879Mab879
committed
Add new rule system_boot_in_fips_mode
1 parent bf4ee45 commit a9802f7

File tree

9 files changed

+95
-9
lines changed

9 files changed

+95
-9
lines changed

‎components/fips.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,4 @@ rules:
1212
- package_dracut-fips_installed
1313
- sebool_fips_mode
1414
- sysctl_crypto_fips_enabled
15+
- system_boot_in_fips_mode

‎controls/ism_o.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -430,7 +430,7 @@ use of device access control software or by disabling external communication int
430430
rules:
431431
- configure_crypto_policy
432432
- enable_dracut_fips_module
433-
- enable_fips_mode
433+
- system_boot_in_fips_mode
434434
- var_system_crypto_policy=fips
435435
status: automated
436436

‎controls/srg_gpos/SRG-OS-000396-GPOS-00176.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,6 @@ controls:
88
rules:
99
- configure_crypto_policy
1010
- package_crypto-policies_installed
11-
- enable_fips_mode
11+
- system_boot_in_fips_mode
1212
- sysctl_crypto_fips_enabled
1313
status: automated

‎controls/srg_gpos/SRG-OS-000478-GPOS-00223.yml‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,7 @@ controls:
88
protection in accordance with applicable federal laws, Executive Orders, directives,
99
policies, regulations, and standards.'
1010
rules:
11-
- enable_dracut_fips_module
12-
- enable_fips_mode
13-
- sysctl_crypto_fips_enabled
11+
- system_boot_in_fips_mode
1412
- aide_use_fips_hashes
1513
- configure_kerberos_crypto_policy
1614
status: automated

‎linux_os/guide/system/software/integrity/fips/is_fips_mode_enabled/rule.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
documentation_complete: true
22

33

4-
title: Verify '/proc/sys/crypto/fips_enabled' exists
4+
title: Verify '/proc/sys/crypto/fips_enabled' exists
55

66
description: |-
77
On a system where FIPS 140-2 mode is enabled, <tt>/proc/sys/crypto/fips_enabled</tt> must exist.
@@ -17,6 +17,7 @@ rationale: |-
1717
severity: high
1818

1919
identifiers:
20+
cce@rhel10: CCE-86203-7
2021
cce@sle12: CCE-83224-6
2122
cce@sle15: CCE-85763-1
2223
cce@slmicro5: CCE-93785-4
@@ -41,7 +42,7 @@ ocil: |-
4142
warnings:
4243
- general: |-
4344
To configure the OS to run in FIPS 140-2 mode, the kernel parameter "fips=1" needs to be added during its installation.
44-
Enabling FIPS mode on a preexisting system involves a number of modifications to it. Refer to the vendor installation
45+
Enabling FIPS mode on a preexisting system involves a number of modifications to it. Refer to the vendor installation
4546
guidances.
4647
- regulatory: |-
4748
System Crypto Modules must be provided by a vendor that undergoes

‎linux_os/guide/system/software/integrity/fips/system_boot_in_fips_mode/oval/shared.xml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<def-group>
2+
<definition class="compliance" id="{{{ rule_id }}}" version="1">
3+
{{{ oval_metadata("The system must be booted with fips=1 and /proc/cmdline must not contain fips=0") }}}
4+
<criteria operator="AND">
5+
<criterion comment="FIPS mode is enabled" test_ref="test_{{{ rule_id }}}_mode_exists" />
6+
<criterion comment="FIPS mode is not disabled" test_ref="test_{{{ rule_id }}}_not_disabled" />
7+
</criteria>
8+
</definition>
9+
10+
<ind:textfilecontent54_test check="all" check_existence="all_exist" comment="FIPS mode is enabled" id="test_{{{ rule_id }}}_mode_exists" version="1">
11+
<ind:object object_ref="obj_{{{ rule_id }}}_mode_exists" />
12+
</ind:textfilecontent54_test>
13+
14+
<ind:textfilecontent54_test check="all" check_existence="none_exist" id="test_{{{ rule_id }}}_not_disabled" version="1" comment="FIPS mode isn't disable">
15+
<ind:object object_ref="obj_{{{ rule_id }}}_not_disabled" />
16+
</ind:textfilecontent54_test>
17+
18+
<ind:textfilecontent54_object id="obj_{{{ rule_id }}}_mode_exists" version="1">
19+
<ind:filepath>/proc/cmdline</ind:filepath>
20+
<ind:pattern operation="pattern match">.+fips*=1.+</ind:pattern>
21+
<ind:instance datatype="int">1</ind:instance>
22+
</ind:textfilecontent54_object>
23+
24+
<ind:textfilecontent54_object id="obj_{{{ rule_id }}}_not_disabled" version="1">
25+
<ind:filepath>/proc/cmdline</ind:filepath>
26+
<ind:pattern operation="pattern match">.+fips*=0.+</ind:pattern>
27+
<ind:instance datatype="int">1</ind:instance>
28+
</ind:textfilecontent54_object>
29+
30+
</def-group>

‎linux_os/guide/system/software/integrity/fips/system_boot_in_fips_mode/rule.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
documentation_complete: true
2+
3+
title: 'Verify that the system was booted with fips=1'
4+
5+
description: |-
6+
On a system where FIPS 14032 mode is enabled, the system must be booted with the
7+
<tt>fips=1</tt> kernel argument.
8+
To verify FIPS mode, run the following command:
9+
<pre>cat /proc/cmdline</pre>
10+
11+
rationale: |-
12+
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
13+
protect data. The operating system must implement cryptographic modules adhering to the higher
14+
standards approved by the federal government since this provides assurance they have been tested
15+
and validated.
16+
17+
severity: high
18+
19+
identifiers:
20+
cce@rhel10: CCE-86247-4
21+
22+
references:
23+
disa: CCI-002450
24+
nist: SC-12(2),SC-12(3),SC-13
25+
srg: SRG-OS-000396-GPOS-00176,SRG-OS-000478-GPOS-00223
26+
27+
ocil_clause: 'thee system is not booted with fips=1'
28+
29+
ocil: |-
30+
To verify that system is booted with <tt>fips=1</tt> run the following command:
31+
$ cat /proc/cmdline
32+
33+
The output must contain <tt>fips=1</tt>
34+
35+
warnings:
36+
- general: |-
37+
To configure the OS to run in FIPS 140-3 mode, the kernel parameter "fips=1" needs to be added during its installation.
38+
Enabling FIPS mode on a preexisting system involves a number of modifications to it and therefore is not supported.
39+
- regulatory: |-
40+
System Crypto Modules must be provided by a vendor that undergoes
41+
FIPS-140 certifications.
42+
FIPS-140 is applicable to all Federal agencies that use
43+
cryptographic-based security systems to protect sensitive information
44+
in computer and telecommunication systems (including voice systems) as
45+
defined in Section 5131 of the Information Technology Management Reform
46+
Act of 1996, Public Law 104-106. This standard shall be used in
47+
designing and implementing cryptographic modules that Federal
48+
departments and agencies operate or are operated for them under
49+
contract. See <b>{{{ weblink(link="https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-3.pdf") }}}</b>
50+
To meet this, the system has to have cryptographic software provided by
51+
a vendor that has undergone this certification. This means providing
52+
documentation, test results, design information, and independent third
53+
party review by an accredited lab. While open source software is
54+
capable of meeting this, it does not meet FIPS-140 unless the vendor
55+
submits to this process.

‎linux_os/guide/system/software/integrity/fips/system_boot_in_fips_mode/tests/default.pass.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/bash
2+
3+
echo ''

‎shared/references/cce-redhat-avail.txt‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ CCE-86196-3
1313
CCE-86198-9
1414
CCE-86199-7
1515
CCE-86202-9
16-
CCE-86203-7
1716
CCE-86204-5
1817
CCE-86206-0
1918
CCE-86207-8
@@ -26,7 +25,6 @@ CCE-86216-9
2625
CCE-86217-7
2726
CCE-86243-3
2827
CCE-86246-6
29-
CCE-86247-4
3028
CCE-86250-8
3129
CCE-86253-2
3230
CCE-86254-0

0 commit comments

Comments
 (0)